Glossary
EPSS
Exploit Prediction Scoring System
The probability, from 0 to 1, that a CVE will be exploited in the next 30 days, published by FIRST.
The Exploit Prediction Scoring System, run by a FIRST special interest group, estimates the probability that a CVE will be exploited in the wild within the next 30 days. The score ranges from 0 to 1 and comes with a percentile that ranks the CVE against all others.
The model is trained on observed exploitation data and on characteristics of each CVE, such as the type of flaw or whether public exploit code exists. Scores are recomputed daily and published for free, through an API and CSV files.
EPSS complements CVSS rather than replacing it: CVSS measures how bad exploitation would be, EPSS how likely it is. A CVE already in the CISA KEV catalog is exploited by definition; EPSS is most useful for sorting the mass of CVEs that are not.