EPSS score lookup: score, percentile and 30-day trend
EPSS estimates how likely exploitation of a CVE is to be observed in the next 30 days. Enter a CVE or a list and you get the score as a percentage, its percentile, a plain-language reading, the 30-day trend and whether CISA lists it in KEV. A threshold picker shows how many of your CVEs would make the first queue at 1%, 5%, 10%, 20% or 50%.
EPSS is a model estimate, not the chance that you are hacked. Pair it with KEV and exposure. Free to use; only the CSV download needs a plan.
Privacy. Pasted lists and uploaded files are read in your browser. Only the CVE ids found in them are sent to our server, to look them up in our own copy of the data. We do not store them, and no third party receives them.
How to read an EPSS score
- Score: a probability from 0 to 1 that exploitation activity is observed in the next 30 days. 0.03 is about 3 in 100.
- Percentile: the share of scored CVEs with the same or a lower score. Useful to rank, misleading as a probability.
- Combine it: in KEV means exploitation is confirmed; EPSS orders the rest; exposure and impact decide urgency (see the BOD 26-04 calculator).
EPSS is a project of FIRST. Scores are generated by Empirical Security and published by the FIRST EPSS SIG. Used with attribution as FIRST requests. Scores come from our daily copy of FIRST's published file; the 30-day trend is read from our stored history, or from FIRST's API for one CVE at a time (cached for a day).
Frequently asked questions
What is EPSS?
The Exploit Prediction Scoring System, from FIRST. For each published CVE it gives a probability between 0 and 1 that exploitation activity will be observed in the next 30 days, and a percentile showing how that score ranks against all scored CVEs. It is recalculated every day.
Is an EPSS score of 0.9 a 90% chance I will be hacked?
No. It is the model's estimate that exploitation attempts against the vulnerability will be seen somewhere, by FIRST's data partners, in the next 30 days. It says nothing about whether your systems are exposed or already patched. Do not describe it as the probability of being hacked.
What is a good or high EPSS score?
There is no official cut-off. Most CVEs score below 1%, so even 5% to 10% is unusual. Teams pick a threshold they can staff: this tool shows how many of your CVEs land above 1%, 5%, 10%, 20% and 50% so you can see the cost of each choice. Combine it with KEV (confirmed exploitation) and exposure.
What is the difference between the EPSS score and the percentile?
The score is an absolute probability. The percentile is relative: the share of all scored CVEs with the same or a lower score. Because most scores are tiny, a CVE can sit at the 70th percentile with a probability under 1%. Read the percentage first.
EPSS vs CVSS vs KEV: which should I use?
They answer different questions. CVSS measures technical severity. EPSS estimates the likelihood that exploitation will be observed soon. KEV records that CISA has evidence of exploitation already. Use KEV first (it is a fact), EPSS to order what is left, and CVSS and your asset context to judge impact. CISA's BOD 26-04 uses KEV, exposure, automatability and technical impact for its federal deadlines.
How often does EPSS update, and which version is current?
FIRST says scores update daily, typically within a minute or two after 13:30 UTC. The data banner at the top shows the model version and score date we hold; at the time of writing the model is v2026.06.15 (EPSS version 5). Each new model version shifts scores, so compare across a version change with care.
Why does the trend chart show a jump?
Either exploitation evidence for that CVE changed (a public exploit, a KEV listing, scanning activity), or the model version changed and all scores shifted. Check the model dates on FIRST's data page.
Does EPSS predict exploitation in my environment?
No. It predicts observed exploitation activity anywhere. It does not know your exposure, your compensating controls or your data. Treat it as one input to prioritisation, next to KEV and exposure.
Sources
Primary documents, accessed 3 November 2026. Our prioritisation labels are ours; the rules, dates and data come from these.
- FIRST, Exploit Prediction Scoring System (EPSS) (accessed 2026-11-03)
- FIRST, EPSS FAQ (update time, meaning of score and percentile) (accessed 2026-11-03)
- FIRST, EPSS data and statistics (model versions) (accessed 2026-11-03)
- FIRST, EPSS API documentation (accessed 2026-11-03)
- Daily EPSS scores CSV (Empirical Security, published for FIRST) (accessed 2026-11-03)
- CISA, Known Exploited Vulnerabilities Catalog (accessed 2026-11-03)
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (issued 10 June 2026) — Table 1, definitions, clock start, calendar days, revokes BOD 19-02 and BOD 22-01 (accessed 2026-11-03)
Educational, not advice. BOD 26-04 binds US federal civilian agencies; for everyone else it is a published benchmark. Score severity with the CVSS calculator.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.