▲ EPSS Score — Exploit Probability (high → low)
~85% of CVEs are noise (bottom-left). Focus energy on the top row — especially top-right where severity meets active exploitation.
Two vulnerability scores. Same CVE. Completely different conclusions.
CVSS says: 9.8 — Critical. Patch immediately.
EPSS says: 0.02 — 2% chance anyone exploits this in the next 30 days. Routine maintenance.
Which one is right? Both. They're answering different questions. And understanding that difference is the key to not burning out your team on vulnerabilities that don't matter.
TL;DR: CVSS measures theoretical severity (how bad a vulnerability could be if exploited). EPSS measures exploitation probability (whether anyone will actually exploit it in the next 30 days). CVSS is static and based on technical characteristics. EPSS is dynamic and based on real-world threat intelligence. For prioritization, EPSS is the stronger signal. For compliance, CVSS still matters. For the full framework that combines both with CISA KEV, see the 3-Signal Triage Method. Need VEX and SSVC too? See the full Vulnerability Scoring Systems Glossary.
Side-by-Side Comparison
| Dimension | CVSS | EPSS |
|---|---|---|
| Full name | Common Vulnerability Scoring System | Exploit Prediction Scoring System |
| Maintained by | FIRST.org | FIRST.org |
| Scale | 0.0–10.0 | 0.0–1.0 (probability) |
| Question answered | "How bad could this be?" | "Will this be exploited in 30 days?" |
| Input data | Attack vector, complexity, privileges, impact | Threat intel, PoC code, malware feeds, dark web |
| Update frequency | Rarely (usually set once at disclosure) | Daily (retrains on new intelligence) |
| Type | Deterministic (expert assessment) | Probabilistic (machine learning) |
| Compliance use | Required by PCI-DSS, NIST, FedRAMP | Not yet required (growing adoption) |
| Best for | Understanding blast radius | Deciding what to patch first |
The fundamental tension: CVSS tells you about the vulnerability. EPSS tells you about the threat landscape.
That "Update frequency" row is about the score itself, not the underlying advisory data feeding it — a separate question we measured directly. Across 48,162 CVEs and eight package ecosystems, the median gap between an NVD disclosure and the matching registry advisory is 0.01 days, and on some ecosystems the registry advisory usually arrives first — see our advisory-lag research. So a stale CVSS score is rarely a data-availability problem; it's that nobody revisited the number after EPSS moved.
Where They Agree
CVSS and EPSS align when a vulnerability is both severe and actively targeted:
CVE-2021-44228 (Log4Shell)
CVSS: 10.0 — Maximum severity. RCE, no auth required.
EPSS: 0.97 — Near-certain exploitation.
Verdict: Both say PATCH NOW. No ambiguity.
CVE-2024-3094 (xz backdoor)
CVSS: 10.0 — Supply chain RCE.
EPSS: 0.91 — Active exploitation detected.
Verdict: Both say PATCH NOW. No ambiguity.
When the world is on fire, both scoring systems agree. The problem is that the world is rarely on fire. Most of the time, CVSS and EPSS tell you very different things — and that's where the value lies. See Log4Shell's live record for how both scores read today, years after the fact.
Where They Diverge: 3 Real-World Examples
Example 1: The "Critical" Nobody Cares About
CVE-2023-XXXXX — XML External Entity in legacy parser
CVSS: 9.1 (Critical)
EPSS: 0.01
CVSS reasoning: Remote, no auth, data exfiltration possible
EPSS reasoning: No PoC code, no malware using it, niche library
npm audit says: CRITICAL — patch immediately
3-Signal Method says: Routine maintenance (EPSS < 0.1)
This is the most common divergence. CVSS sees the technical characteristics and rates it Critical. EPSS sees that nobody in the threat landscape is interested in exploiting it. Both are correct — it would be bad if exploited, but it almost certainly won't be.
Teams that prioritize by CVSS alone will burn a day on this while genuinely exploited vulnerabilities wait.
Example 2: The "Moderate" That's Being Weaponized
CVE-2024-YYYYY — Authentication bypass in middleware
CVSS: 5.3 (Medium)
EPSS: 0.74
CVSS reasoning: Requires specific configuration, limited impact
EPSS reasoning: Public PoC, active scanning detected, malware adopting it
npm audit says: MODERATE — schedule for next quarter
3-Signal Method says: Patch this week (EPSS 0.7+)
This is the dangerous divergence. CVSS underrates the urgency because the theoretical impact is moderate. EPSS overrides that because real attackers are using it right now. A team following CVSS-only prioritization would schedule this for next quarter while threat actors exploit it this week.
Example 3: The Moving Target
CVE-2025-ZZZZZ — Deserialization flaw in popular framework
Day 1: CVSS 8.1 | EPSS 0.08 — High severity, low exploitation
Day 14: CVSS 8.1 | EPSS 0.12 — PoC published on GitHub
Day 21: CVSS 8.1 | EPSS 0.67 — Metasploit module released
Day 28: CVSS 8.1 | EPSS 0.89 — Active scanning in the wild
CVSS didn't change. EPSS tracked the escalation in real time.
This is the fundamental architectural difference. CVSS is a snapshot — set once, rarely updated. EPSS is a time series — recalculated daily as the threat landscape evolves. By day 28, CVSS still says the same thing it said on day 1. EPSS tells you the situation has changed dramatically.
When to Use Each Score
Use CVSS when you need to:
- Meet compliance requirements (PCI-DSS, HIPAA, FedRAMP mandates)
- Understand the type of risk (RCE vs info disclosure vs DoS)
- Communicate severity to non-technical stakeholders
- Set baseline SLAs ("all CVSS 9.0+ within 14 days")
Use EPSS when you need to:
- Decide what to patch first within your CVSS-mandated window
- Cut through alert fatigue (85% of CVEs have EPSS below 0.1)
- Detect emerging threats before they become incidents
- Justify deprioritizing high-CVSS findings that nobody's exploiting
Use both (the 3-Signal Triage Method) when you need to:
- Build a repeatable prioritization process
- Defend your patch decisions to auditors and leadership
- Reduce patching effort by 70-80% without increasing risk
The Overlap Problem
Some vulnerability scanners are starting to show EPSS scores, but most still sort by CVSS. This creates a UX problem: your scanner screams "CRITICAL" for a CVSS 9.8 finding while burying a CVSS 4.0 that's actively being exploited.
Scanner output sorted by CVSS (typical): Sorted by EPSS (better):
─────────────────────────────── ──────────────────────────
1. CVE-A CVSS 9.8 EPSS 0.01 ← noise 1. CVE-C EPSS 0.74 CVSS 5.3 ← real threat
2. CVE-B CVSS 8.1 EPSS 0.03 ← noise 2. CVE-D EPSS 0.31 CVSS 7.2 ← elevated
3. CVE-C CVSS 5.3 EPSS 0.74 ← REAL THREAT 3. CVE-B EPSS 0.03 CVSS 8.1 ← routine
4. CVE-D CVSS 7.2 EPSS 0.31 ← elevated 4. CVE-A EPSS 0.01 CVSS 9.8 ← routine
The right-hand column is a better patch plan. The item your team should work on first (CVE-C) is buried at position 3 in the CVSS-sorted view. GeekWala sorts by EPSS by default, so this reordering happens automatically instead of requiring a spreadsheet.
Does CVSS predict exploitation?
No. CVSS describes blast radius — how bad a vulnerability could be if exploited — based on static technical characteristics (attack vector, attack complexity, impact on confidentiality/integrity/availability). It says nothing about whether anyone will actually exploit it. A 2015 CVE still reads CVSS 9.8 today regardless of whether it has been weaponized, ignored, or forgotten. If you need an answer to "will this be exploited?", you need EPSS — see What is EPSS? for how the model actually derives that probability.
Can I use EPSS without CVSS?
Operationally yes — EPSS alone will correctly prioritize the vulnerabilities most likely to be exploited, and research by the FIRST EPSS team shows it outperforms CVSS-only prioritization at catching real exploitation. But you lose the impact signal: a CVE with EPSS 0.9 on a developer workstation is a different risk than the same CVE on an internet-facing payment service. Keep CVSS for blast-radius framing, compliance reporting, and risk-appetite conversations with leadership; use EPSS to decide which ones to actually fix this week.
How do I combine CVSS severity with EPSS probability?
Triage by a 3-signal rule: CISA KEV → ship the fix today; EPSS ≥ 0.1 with a CVSS ≥ 7.0 and a reachable attack path → ship this week; CVSS-only critical in runtime code → schedule in the next sprint; everything else → normal patch cadence. The 3-Signal Triage Method walks through this in detail and shows how to turn both scores plus KEV membership into a single ordered queue your team can burn down.
Is EPSS replacing CVSS?
No. EPSS complements CVSS — it doesn't replace it. CVSS remains important for compliance, blast radius assessment, and communication. EPSS adds the exploitation dimension that CVSS was never designed to provide.
Can a vulnerability have high EPSS and low CVSS?
Yes, and it's more common than you'd expect. Authentication bypasses, SSRF, and path traversal flaws often score CVSS 4–6 (moderate impact) but attract high exploitation activity because they're easy to weaponize. Don't let a moderate CVSS score lull you into ignoring a high EPSS score.
Which score should I show my CISO?
Both, but frame them differently. CVSS answers "what's the worst case?" — useful for risk appetite discussions. EPSS answers "what's likely to happen?" — useful for resource allocation. The 3-Signal Triage Method gives you a framework to present both in context.
How accurate is EPSS compared to CVSS?
Research by the FIRST EPSS team (Jacobs et al.) shows that EPSS-based prioritization catches more actually-exploited vulnerabilities while generating fewer false positives than CVSS-based prioritization. In their analysis, at most about 6% of CVEs are ever exploited — the most generous of the published estimates, with stricter datasets nearer 1–2% — and EPSS is significantly better at identifying that slice.
See both scores for your dependencies — sorted by what matters.
Scan your dependencies now → — every finding shows CVSS severity alongside EPSS exploitation probability and CISA KEV status. No more guessing which "Critical" findings actually need emergency action. No account needed.
