Question 1

Does "6%" mean I can ignore the other 94%?

Accepted Answer

No. It means you can deprioritize them. The 94% are still real vulnerabilities that deserve patching — just not at emergency priority. Patch them during scheduled maintenance, dependency update cycles, or quarterly security sweeps. The goal is to stop treating them with the same urgency as the 6% that are actually being weaponized.

Question 2

Could a CVE in the 94% become part of the 6% later?

Accepted Answer

Absolutely. A CVE with EPSS 0.01 today can spike to 0.8 next week when a proof-of-concept is published. This is why regular re-scanning matters — EPSS updates daily, and the 3-Signal Triage Method catches these transitions. A vulnerability moves from the 94% to the 6% when threat actors start paying attention to it.

Question 3

Is 6% the same across all ecosystems?

Accepted Answer

The overall rate is roughly consistent, but exploitation patterns vary by ecosystem. npm vulnerabilities in widely-used packages like Express have higher exploitation rates than niche Rust crates. The 6% is an aggregate — your specific ecosystem may be higher or lower, which is why per-CVE EPSS scores matter more than the aggregate statistic.

Question 4

How does this relate to CVSS severity levels?

Accepted Answer

Poorly, which is the point. High-CVSS vulnerabilities are only slightly more likely to be exploited than medium-CVSS ones. Research shows CVSS 9.0+ vulnerabilities have roughly a 12% exploitation rate — better than average, but still meaning 88% of "Critical" findings are never exploited. EPSS is a far stronger predictor of actual exploitation than CVSS severity. For the full comparison of CVSS vs EPSS, see our head-to-head analysis.