What is EPSS and how is it different from CVSS?
EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days, expressed as a value between 0 and 1. CVSS measures how damaging exploitation would be; EPSS estimates how likely it is to happen. They answer different questions and are strongest when used together.
EPSS is maintained by FIRST and is rebuilt from observed exploitation data, so a given CVE's score moves over time as evidence accumulates. A vulnerability can be published with a low EPSS and climb sharply once proof-of-concept code circulates.
The two scores disagree constantly, and that disagreement is the useful part. A large share of Critical-rated CVEs carry very low exploitation probability, while a handful of moderately-rated ones are being actively used.
A workable prioritisation order for most teams: anything in CISA KEV first, then high EPSS combined with high CVSS on internet-facing systems, then everything else on a normal patch cycle.
Related coverage
CVE & Vulnerabilitiesdispatches →Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
More on prioritisation