What EPSS said the day before CISA listed a CVE as exploited

While FIRST ran EPSS model v2025.03.14, CISA added 319 CVEs to its Known Exploited Vulnerabilities (KEV) catalog (listings from 18 March 2025 to 15 June 2026). On the day before each listing, 76 of them had no EPSS score at all and another 126 scored under 1%. That is 202 of 319, or 63%, where EPSS gave no useful warning before CISA confirmed exploitation. Most of the gap is timing: 145 of those 202 had no score yet or were 30 days old or less. In our reading that makes it a limit of what any model can know early, not a defect in EPSS, and it changes how a low score on a new CVE should be read.

No score yet76 (23.8%)

Under 1%126 (39.5%)

1% to 10%35 (11.0%)

10% to 50%28 (8.8%)

50% or more54 (16.9%)

Show as a table

EPSS the day before listing	CVEs	Share
No score yet	76	23.8%
Under 1%	126	39.5%
1% to 10%	35	11.0%
10% to 50%	28	8.8%
50% or more	54	16.9%
Total	319	100%

Why so many had no warning: KEV moves faster than EPSS can learn

EPSS is a model trained against observed exploitation. Some of its inputs exist from day one, such as the vendor, the weakness type, the CVSS vector and the description. Many of the strongest ones accumulate after a CVE goes public: exploit code on GitHub and in frameworks, mentions in security feeds, and KEV listing itself. A CVE that is a few days old has little of that yet, so its score starts low or does not exist. KEV works from a different input, CISA's evidence of attacks, and often has it within days.

The ages in the data bear this out. Every one of the 76 unscored CVEs was added to KEV no later than the day after NVD published it, and 7 were listed before NVD published at all; they were not in FIRST's score file yet because they were brand new. The 126 that scored under 1% had a median age of 14.5 days at listing, and 69 of them were under a month old.

KEV's speed shows up across its whole history. Of the 873 CVEs published since the catalog launched in November 2021 and later listed, the median gap from NVD publication to KEV listing was 8 days. 27% were listed on or before the day NVD published them, which happens when a flaw is disclosed while it is already under attack. Just under half (49.8%) were listed within a week.

One case shows the pattern. Ivanti published CVE-2025-4427, an authentication bypass in Endpoint Manager Mobile, on 13 May 2025. Attackers chained it with CVE-2025-4428 for unauthenticated remote code execution. On 18 May its EPSS score was 4.9%. CISA listed it on 19 May. Its score today is 99.9%, though that partly reflects the listing, since KEV membership is one of EPSS's inputs. That is why this analysis uses the day before. Note that 4.9% already put it in the 89th percentile that day: a raw score that looks small can still rank a CVE above most others, so read the percentile beside it.

It is not only new CVEs

Timing explains most of the gap, not all of it. 13 of the 126 low scorers were over a year old when CISA listed them, so EPSS had had time and still rated them unlikely. More broadly, KEV keeps adding old bugs: of the 1,467 CVEs added after the initial catalog load, 42.6% were over a year old at listing and 19.9% were over five years old. A legacy CVE with a quiet EPSS history can still turn up in KEV when someone finds a new use for it.

Each EPSS model, separately

FIRST has changed the EPSS model four times since 2021, and raw scores from different versions are not on the same scale. The table reports each version on its own. Read it as five separate snapshots, not as a trend: the 2022 period is dominated by CISA bulk-adding long-known exploited bugs, which EPSS had years of data on, while the later periods contain a larger share of fresh ones.

"No useful warning" is no score or under 1%, as a share of all additions in that period. Median percentile is among CVEs that had a score.

What CVSS said

CVSS tells a different story, because it measures how bad a vulnerability would be, not whether anyone is using it. NVD has scored 1,371 of the 1,754 KEV entries with CVSS v3, and 89% of those are 7.0 or higher, though only 37% reach Critical (9.0 or higher). So exploited CVEs are usually rated High or Critical, and more often High.

The reverse does not hold. Of the 3,037 CVEs published in 2024 that NVD rated Critical (9.0 or higher), 63 are in KEV today: 2.1%. 68% of that cohort has a current EPSS score under 1%. For this cohort at least, an NVD Critical rating on its own was a weak predictor of exploitation, which is why patching strictly by CVSS spends most of the effort on bugs with no confirmed exploitation.

Which CVSS score you are reading also matters. A CVE record can carry scores from NVD, from the vendor that reported it, and from CISA's ADP program. Among the 401 KEV entries that have both an NVD and a vendor score, the two disagree 47% of the time, and NVD is the higher one in 54% of those disagreements. CVE-2013-3900, a Windows signature-validation flaw in KEV since January 2022, is scored 5.5 by Microsoft and 8.8 by NVD. Microsoft rates it a local attack with no confidentiality or availability impact; NVD rates it network-reachable with high impact on all three. When the scores differ, compare the vectors to see which assumption differs.

What to do with this

• Check KEV first. For about a quarter of recent KEV entries, the listing came before EPSS had produced any score at all.
• Do not read a low EPSS on a new CVE as reassurance. Under a month old, a low score mostly means EPSS has not seen enough yet. Re-check new CVEs on internet-facing systems daily for their first few weeks.
• Read the percentile with the score. Ivanti's 4.9% was in the top 11% that day.
• Know whose CVSS score you have. NVD and vendor scores split on nearly half of the KEV entries scored by both.
• For a fresh CVE in an edge device or remote-access product, act on the vendor advisory. Words like "exploited in limited attacks" or a public proof of concept are earlier signals than any score.

The lookup tool on this site shows KEV status, EPSS with its percentile, and the CVSS score with who assigned it, in one query.

Method and limitations

• Sources. CISA KEV catalog version 2026.10.21 (1,754 entries). EPSS scores from FIRST's API for the day before each entry's dateAdded. NVD CVE API 2.0 records, pulled 22 and 23 October 2026.
• Exclusions. The 287 entries from the catalog's first day, 3 November 2021, are left out of the EPSS analysis: their listing date marks when KEV started, not when exploitation was confirmed.
• Missing days. FIRST has no score file for a few dates. For 8 entries the file from two days before listing was used. A CVE absent from a published day's file counts as "no score".
• Model versions. Version boundaries come from the model_version header in FIRST's daily files. Files before 4 February 2022 carry no header, so the "v1" label for that period is inferred. Raw scores are compared only within a version.
• Listing date is not exploitation date. Attacks usually start before CISA lists a CVE. Measuring EPSS the day before listing is therefore generous to EPSS: it is the latest point at which it could have warned.
• Publication date. "Age" uses NVD's publication date. Some vendors disclose earlier.
• CVSS sources. Scores are attributed by the record's source field (NVD, CISA-ADP or the vendor), not by its Primary/Secondary flag, which on many Microsoft records marks the vendor's score as Primary. The 2024 cohort comes from NVD's Critical-severity filter, which matches only the Primary score; all 3,037 carry a 9.0+ from NVD itself. CVEs that only their vendor rated Critical, common during NVD's 2024 enrichment backlog, are not in it. If NVD enriched KEV-listed CVEs first, the 2.1% figure would be pushed upward; we have not tested that.
• What was decided in advance. The four core questions (EPSS before listing per model version, time to listing, CVSS of KEV entries, exploitation of 2024 Critical CVEs) were fixed before the data was examined. The percentile view and the age breakdown of low scorers were added after seeing the first results.

Data: per-CVE dataset (CSV, one row per KEV entry) and summary results (JSON). Figures as of 23 October 2026.