A backlog with 1,000 vulnerable packages does not mean your team has 1,000 equally urgent fires. Some vulnerabilities have scary severity scores but almost no attacker interest. Others look “medium” on paper while exploit code spreads across scanning tools, botnets, and ransomware playbooks.
That is why the EPSS score vulnerability conversation matters. CVSS tells you how bad a vulnerability could be in theory. EPSS, the Exploit Prediction Scoring System, estimates how likely a CVE is to be exploited in the wild during the next 30 days. For practical patching, that difference can decide whether engineers fix the right package today or spend a sprint chasing risk that attackers are ignoring.
Why CVSS Score Alone Fails as a Prioritization Tool
Only a small fraction of published CVEs are observed being exploited in the wild, so severity-only patching creates large amounts of wasted remediation effort.
Common Vulnerability Scoring System is useful, but it was not designed to answer one question security teams face every day: “Which vulnerability should we fix first?” CVSS measures technical severity. It considers factors such as network access, required privileges, user interaction, scope, confidentiality impact, integrity impact, and availability impact. That creates a standardized severity score from 0.0 to 10.0.
The problem is that technical severity does not equal real-world exploitation. A CVSS 9.8 vulnerability can require a rare configuration, an unusual deployment pattern, or access to a component that your company does not expose. A CVSS 7.2 vulnerability can affect an internet-facing service with public exploit code and active attacker interest. Under a CVSS-only model, the 9.8 comes first. Under a risk-informed model, the 7.2 may demand immediate action.
For open source dependency security, this problem gets worse fast. A single application can include hundreds of direct and transitive dependencies. If every high CVSS issue becomes an urgent ticket, engineers stop trusting vulnerability alerts. They either delay everything or patch whichever item looks easiest. That is not a vulnerability management strategy. It is queue exhaustion.
Warning: CVSS is still valuable. Do not remove it. Use it with EPSS, asset exposure, package reachability, business criticality, and CISA KEV status.
What EPSS Is and How It Works
Exploit Prediction Scoring System is a data-driven model maintained by FIRST.org. It estimates the probability that a published CVE will be exploited in the wild during the next 30 days. EPSS outputs a score between 0 and 1, which can also be read as a percentage. A score of 0.87 means an estimated 87% probability of exploitation within the next 30 days. A score of 0.004 means an estimated 0.4% probability.
EPSS is not another severity label. It is exploit prediction scoring. The model uses signals such as historical exploitation patterns, CVE metadata, public exploit availability, vulnerability characteristics, vendor and product signals, references, and threat intelligence indicators. The score changes over time because attacker behavior changes over time.
This makes EPSS useful for prioritization. When a new vulnerability appears in a widely deployed package, the EPSS score may start low and rise as proof-of-concept code, exploit framework modules, scanning activity, and threat intelligence signals appear. When the hype fades and no exploitation appears, the score may remain low or drop compared with other CVEs.
A practical EPSS score vulnerability workflow does not ask, “Is the CVSS score high?” It asks, “Is this vulnerability severe, likely to be exploited soon, present in my environment, and reachable by attackers?” That gives teams a better basis for deciding what to patch now, what to schedule, and what to accept temporarily.
Terms to Know
-
CVE: A Common Vulnerabilities and Exposures identifier, such as
CVE-2021-44228, that names a publicly disclosed vulnerability. - CVSS: A severity scoring system that measures technical impact and exploitability characteristics on a 0.0 to 10.0 scale.
- EPSS: A probability score from 0 to 1 that estimates exploitation likelihood in the next 30 days.
- CISA KEV: The Known Exploited Vulnerabilities catalog, which lists vulnerabilities with confirmed exploitation in the wild.
- SBOM: A Software Bill of Materials that lists software components and dependencies used in an application.
EPSS vs CVSS — A Side by Side Comparison
EPSS and CVSS answer different questions. Security teams run into trouble when they treat one score as a replacement for all other context.
| Aspect | CVSS | EPSS |
|---|---|---|
| Main question | How severe could this vulnerability be? | How likely is exploitation in the next 30 days? |
| Score format | 0.0 to 10.0 severity score | 0 to 1 probability score |
| Best use | Technical impact assessment | Exploit likelihood prioritization |
| Changes over time | Usually static after scoring | Updated as exploitation signals change |
| Example signal | Network attack vector, no user interaction, high impact | Public exploit code, observed exploitation, threat activity |
| Main weakness | Can over-prioritize severe but unused bugs | Needs context because probability alone is not business risk |
Think of CVSS as blast radius and EPSS as attacker interest. A vulnerability with huge blast radius but no attacker path still deserves attention, but it may not always deserve emergency treatment. A vulnerability with moderate blast radius and high attacker interest may deserve immediate action, especially when it affects an internet-facing service.
CVE-A: CVSS 9.8, EPSS 0.004, internal-only component, no public exploit.
CVE-B: CVSS 7.2, EPSS 0.87, internet-facing component, public exploit available.
Under CVSS-only prioritization, CVE-A gets fixed first. Under EPSS-informed prioritization, CVE-B gets fixed first because attackers are much more likely to use it soon.
Tip: Use EPSS to sort the backlog, not to delete the backlog. Low EPSS vulnerabilities can still matter when they affect crown-jewel systems or sensitive data paths.
Reading EPSS Scores in Practice
An EPSS score looks simple, but teams should read it carefully. A score of 0.10 means 10% probability of exploitation in the next 30 days. In security operations, 10% is not small when the affected asset is internet-facing, business-critical, or widely deployed across many applications.
- EPSS above 0.50: Treat as a strong exploitation signal, especially for exposed systems.
- EPSS 0.10 to 0.50: Prioritize quickly when CVSS is high or the affected asset is exposed.
- EPSS 0.05 to 0.10: Review during sprint planning and combine with CVSS and asset context.
- EPSS below 0.01: Usually lower priority unless business impact, exposure, or compliance pressure changes the decision.
Real CVEs show why this matters. CVE-2021-44228, the Log4Shell remote code execution vulnerability in Apache Log4j 2, received a CVSS score of 10.0. It affected Log4j versions before 2.15.0 and triggered emergency patching across Java ecosystems.
CVE-2023-34362, the MOVEit Transfer SQL injection vulnerability, affected Progress MOVEit Transfer versions before patched releases including 2023.0.1. Exploitation became a major incident driver, making it a clear example where known exploitation and internet exposure mattered more than ordinary queue order.
CVE-2024-3094, the XZ Utils backdoor, affected xz versions 5.6.0 and 5.6.1. It received critical severity because the potential impact was severe, but real prioritization still depended on affected versions, distribution exposure, and deployment paths.
How to Check EPSS for Any CVE
The fastest way to check EPSS is the FIRST API. Replace the CVE ID with the vulnerability you want to evaluate.
curl "https://api.first.org/data/v1/epss?cve=CVE-2021-44228"
The response returns the CVE, EPSS probability, percentile, and date. The probability is the number most teams use for triage. The percentile shows how the CVE ranks compared with other CVEs.
curl "https://api.first.org/data/v1/epss?cve=CVE-2023-34362,CVE-2024-3094,CVE-2019-19781"
For CVSS details, use NVD or vendor advisories. For confirmed exploitation, check the CISA Known Exploited Vulnerabilities catalog. For open source dependencies, combine the CVE data with your manifest files, lockfiles, and SBOMs.
The Combined Prioritization Framework: CVSS + EPSS + KEV
The strongest vulnerability prioritization model uses three signals together: severity, exploit likelihood, and confirmed exploitation. CVSS gives severity. EPSS gives probability. CISA KEV gives confirmation that exploitation has already happened in the wild.
| Tier | Criteria | Action |
|---|---|---|
| Tier 1 | CVSS 7.0+ and EPSS > 0.10 and internet-exposed, or any CISA KEV match | Fix immediately |
| Tier 2 | CVSS 7.0+ and EPSS > 0.05 | Fix this sprint |
| Tier 3 | CVSS above 4.0 with lower EPSS or limited exposure | Fix this quarter |
| Tier 4 | CVSS below 4.0 and EPSS below 0.01 | Accept, monitor, or defer with approval |
This framework gives engineering teams a clear order of operations. Instead of saying, “This is critical because the score is red,” the security team can say, “This affects an internet-facing service, has CVSS 9.8, has EPSS above 10%, and appears in KEV. It needs a same-day fix.”
Warning: If a CVE appears in CISA KEV, treat it as confirmed exploited. Do not wait for EPSS to rise before taking action.
Integrating EPSS Into Your Vulnerability Management Process
EPSS becomes powerful when it changes daily behavior. Adding another column to a spreadsheet is not enough. The score should affect triage, ticket creation, SLA deadlines, dashboard sorting, executive reporting, and developer communication.
Start with your dependency inventory. For open source applications, that means collecting manifest files and lockfiles such as package-lock.json, yarn.lock, pom.xml, build.gradle, requirements.txt, Pipfile.lock, poetry.lock, composer.lock, go.sum, Gemfile.lock, Cargo.lock, pubspec.lock, mix.lock, *.csproj, packages.lock.json, and SBOM formats such as SPDX and CycloneDX.
Next, enrich every detected CVE with CVSS, EPSS, KEV status, affected package, installed version, fixed version, and application owner. This turns vulnerability management from a generic alert queue into an engineering workflow.
npm audit --production
npm install package-name@patched-version
composer audit
composer update vendor/package
pip-audit
pip install --upgrade package-name
Vulert helps with this workflow by analyzing manifest files and SBOMs against a database of 458,000+ known CVEs. Teams can upload a manifest or SBOM, receive a vulnerability report in about 60 seconds, and get fix guidance with exact versions and commands.
Vulert also groups vulnerabilities by package, so a long list such as “133 CVEs” can become a practical plan such as “fix 3 packages to remove most of the risk.” This makes EPSS prioritization easier to turn into real developer tickets.
Key Takeaways
- CVSS measures technical severity, while EPSS estimates exploitation probability in the next 30 days.
- An EPSS score vulnerability workflow helps teams patch vulnerabilities attackers are more likely to use soon.
- EPSS should not replace CVSS; use both with CISA KEV, exposure, asset criticality, and package reachability.
- CISA KEV means confirmed exploitation, so KEV vulnerabilities should move into the highest priority tier.
- High CVSS with low EPSS may still matter, but it usually needs context before emergency patching.
- Open source dependency teams should connect EPSS to manifest scanning, SBOM review, fix versions, and developer tickets.
Frequently Asked Questions
1. Is EPSS better than CVSS?
EPSS is not simply better than CVSS. It answers a different question. CVSS measures technical severity, while EPSS estimates exploitation likelihood during the next 30 days. The best prioritization model uses both.
2. Can EPSS be used for open source dependency security?
Yes. EPSS works well with Software Composition Analysis because SCA tools already map packages to CVEs. Once you know which CVEs affect your dependencies, you can add EPSS, CVSS, KEV status, and fix versions to decide which package upgrades should happen first.
3. What EPSS score means I should patch immediately?
A practical starting point is EPSS above 0.10 combined with CVSS 7.0 or higher, especially when the asset is internet-facing. Any CISA KEV vulnerability should be treated as urgent regardless of EPSS.
