Measured 2026-09-12 against the live CISA KEV catalogue (1,709 entries) and the FIRST EPSS API. Every number on this page is recomputed from those two sources when the page rebuilds — nothing is carried over from a previous run.
The question
Vulnerability triage advice has converged on one sentence: patch everything in CISA’s Known Exploited Vulnerabilities catalogue, then rank what is left by EPSS, the model that estimates the probability a vulnerability will be exploited in the next 30 days. Both feeds are public and free. The advice is everywhere.
What is missing is the scoreboard. If EPSS is the early-warning system and KEV is the confirmation, then the two should line up: things EPSS flags should later show up in KEV, and things that show up in KEV should have been flagged first. This page tests both halves of that expectation against a year of data.
Half 1 — when CISA confirms exploitation, had EPSS warned?
CISA added 295 vulnerabilities to KEV in the last 365 days. For each one we read its EPSS score as it stood before the listing, so the score cannot be contaminated by the listing itself.
| Score read | CVEs with a score | Median EPSS | Caught by EPSS > 0.9 | Caught by EPSS > 0.5 | Under 0.10 |
|---|---|---|---|---|---|
| 7 days before listing | 179 | 0.0131 | 6.1% | 21.2% | 63.7% |
| 30 days before listing | 136 | 0.0199 | 8.1% | 27.2% | 59.6% |
| 90 days before listing | 100 | 0.0674 | 10.0% | 33.0% | 51.0% |
A month before CISA confirmed real-world exploitation, the median of these vulnerabilities scored 0.0199 — around 2% estimated probability. 60% of them sat below 0.10, and 45% below 0.01. An alert wired to EPSS > 0.9 would have fired for 8% of them; at the more permissive 0.5 it still only reaches 27%.
The quiet ones
The lowest-scoring examples, 30 days before CISA confirmed they were being exploited:
| CVE | EPSS 30 days earlier | Added to KEV |
|---|---|---|
| CVE-2025-47827 | 0.00005 | 2025-10-14 |
| CVE-2026-20128 | 0.00010 | 2026-04-20 |
| CVE-2025-68461 | 0.00013 | 2026-02-20 |
| CVE-2025-41244 | 0.00014 | 2025-10-30 |
| CVE-2025-54313 | 0.00015 | 2026-01-22 |
| CVE-2026-20122 | 0.00015 | 2026-04-20 |
| CVE-2026-34908 | 0.00017 | 2026-06-23 |
| CVE-2025-43510 | 0.00018 | 2026-03-20 |
| CVE-2025-43520 | 0.00019 | 2026-03-20 |
| CVE-2026-34909 | 0.00023 | 2026-06-23 |
Half 2 — when EPSS is confident, does KEV follow?
The mirror question. Take the CVEs EPSS scored above 0.9 on a past date, drop the ones already in KEV then (those are not predictions), and count how many CISA has added since. A control group scored between 0.05 and 0.10 on the same day gives the base rate — without it a hit rate is unreadable.
| Looking back | Scored > 0.9 then | In KEV now | Hit rate | Control base rate | Lift |
|---|---|---|---|---|---|
| 90 days | 803 | 0 | 0.0% | 0.00% | — |
| 180 days | 823 | 4 | 0.5% | 0.05% | 9× |
| 365 days | 770 | 10 | 1.3% | 0.15% | 8× |
Over a full year, 1.3% of the high-confidence group reached KEV. That is 8 times the base rate, so the score is clearly carrying signal — but in absolute terms, a vulnerability EPSS rates above 90% is still overwhelmingly unlikely to be confirmed by CISA within the year.
Why the two lists disagree
| Age of the CVE when CISA listed it | Count | Share |
|---|---|---|
| same year | 198 | 67.1% |
| 1 year | 35 | 11.9% |
| 2-5 years | 35 | 11.9% |
| over 5 years | 27 | 9.2% |
67% of KEV additions are vulnerabilities published that same year. That is the mechanical reason the warning is missing: EPSS needs observed activity to move a score, and a vulnerability being attacked within weeks of disclosure has not given the model anything to observe yet. It also explains the gaps in the first table — 159 of the 295 had no EPSS score at all 30 days before listing, because the CVE barely existed.
What this means in practice
- EPSS is not an early-warning system for KEV. Treating a low score as permission to defer carries real risk: most of what CISA confirmed was scored low shortly beforehand.
- The two feeds answer different questions. EPSS estimates broad exploitation likelihood across the whole catalogue; KEV records confirmed, observed exploitation, weighted toward what threatens US federal networks. Neither is a substitute for the other, and the common advice to chain them implies a relationship the data does not support.
- Freshly published vulnerabilities are the blind spot. If two thirds of confirmed exploitation lands on same-year CVEs, then vendor advisories and disclosure monitoring — not probability scores — are what cover that window.
- EPSS still beats guessing. The lift over the control group is real. It is useful for ordering a long backlog. It is not useful as a tripwire.
Method and limits
- EPSS scores come from the FIRST API, which serves historical values for any past date. KEV membership and
dateAddedcome from the CISA feed. - A CVE already in KEV on the reference date is excluded from the forecasting cohort — it cannot be predicted after the fact.
- Absence of a score is reported, never treated as zero. Those rows are counted separately and discussed above.
- KEV is not ground truth for exploitation. It is CISA’s confirmed subset, and plenty of real-world exploitation never enters it. This page measures EPSS against KEV specifically, because that is the pairing the standard advice assumes — not against exploitation in general.
- EPSS is a 30-day forward estimate. Comparing it against confirmations that can arrive months later is a deliberately generous test of the score, not a strict reading of its stated window.
Sources: FIRST EPSS and the CISA KEV catalogue. Recomputed monthly; last run 2026-09-12.
