FIRST Exploit Prediction Scoring System

EPSS: predictive vulnerability prioritization

EPSS exploitation probability crossed with NVD severity and CISA KEV known exploitation, without confusing prediction with attack evidence.

FIRST EPSS snapshot

Oct 11, 2026

model v2026.06.15

Interpretation rule

EPSS estimates the probability that a CVE will be exploited in the next 30 days. CISA KEV records known exploitation. When a CVE is in KEV, observed evidence always takes precedence over prediction.

385,738

CVEs scored

4,324

EPSS ≥ 50%

797

EPSS ≥ 90%

38,578

Top model decile

Predictive pressure

1,739

EPSS CVEs already in CISA KEV

Known exploitation: highest precedence.

3,458

High probability outside KEV

Predictive triage signal, not proof of attack.

Probability rising ≥5 pp

Change since the previous snapshot.

Factual reusable data

This queue shows factual fields only: CVE, EPSS, percentile, CVSS, KEV status and dates; it does not republish third-party vulnerability descriptions.

EPSS scores: FIRST — Exploit Prediction Scoring System · snapshot Oct 11, 2026 · KEV status: CISA Known Exploited Vulnerabilities · CVSS: NVD.

Known exploitation: most recent CISA KEV additions

30 shown of 1,739 KEV CVEs with an EPSS score, ordered by first KEV date added. Inside KEV, EPSS is almost always near 100% and does not separate CVEs: confirmed exploitation takes precedence.

CVE-2015-3306CISA KEVCRITICAL

Published in NVD May 18, 2015 · in KEV since Oct 8, 2026 · EPSS unchanged since Oct 10, 2026

EPSS

99.5%

Percentile

99.9%

CVSS

10.0

CVE-2015-5477CISA KEVHIGH

Published in NVD Jul 29, 2015 · in KEV since Oct 8, 2026 · EPSS unchanged since Oct 10, 2026

EPSS

99.4%

Percentile

99.9%

CVSS

7.5

CVE-2016-3081CISA KEVHIGH

Published in NVD Apr 26, 2016 · in KEV since Oct 8, 2026 · EPSS unchanged since Oct 10, 2026

EPSS

96.1%

Percentile

99.9%

CVSS

8.1

CVE-2021-3199CISA KEVCRITICAL

Published in NVD Jan 26, 2021 · in KEV since Oct 8, 2026

EPSS

19.4%

Percentile

97.3%

CVSS

9.8

CVE-2023-22894CISA KEVMEDIUM

Published in NVD Apr 19, 2023 · in KEV since Oct 8, 2026

EPSS

3.6%

Percentile

89.2%

CVSS

4.9

CVE-2026-88779CISA KEVHIGH

Published in NVD Oct 4, 2026 · in KEV since Oct 4, 2026

EPSS

0.6%

Percentile

46.7%

CVSS

8.7

CVE-2026-102489CISA KEVCRITICAL

Published in NVD Sep 30, 2026 · in KEV since Oct 2, 2026

EPSS

1.3%

Percentile

68.7%

CVSS

9.4

CVE-2026-102490CISA KEVCRITICAL

Published in NVD Sep 30, 2026 · in KEV since Oct 2, 2026

EPSS

0.5%

Percentile

44.4%

CVSS

9.4

CVE-2026-104286CISA KEVCRITICAL

Published in NVD Oct 1, 2026 · in KEV since Oct 1, 2026

EPSS

2.2%

Percentile

82.0%

CVSS

9.8

CVE-2026-76504CISA KEVCRITICAL

Published in NVD Sep 30, 2026 · in KEV since Sep 30, 2026

EPSS

1.8%

Percentile

78.1%

CVSS

9.8

CVE-2026-86950CISA KEVHIGH

Published in NVD Sep 28, 2026 · in KEV since Sep 29, 2026

EPSS

1.2%

Percentile

68.4%

CVSS

8.8

CVE-2026-88772CISA KEVCRITICAL

Published in NVD Sep 27, 2026 · in KEV since Sep 27, 2026

EPSS

1.3%

Percentile

69.7%

CVSS

9.5

CVE-2026-88771CISA KEVCRITICAL

Published in NVD Sep 27, 2026 · in KEV since Sep 27, 2026

EPSS

1.1%

Percentile

64.3%

CVSS

9.5

CVE-2026-87902CISA KEVHIGH

Published in NVD Sep 22, 2026 · in KEV since Sep 25, 2026

EPSS

40.0%

Percentile

98.6%

CVSS

8.1

CVE-2026-65660CISA KEVHIGH

Published in NVD Aug 11, 2026 · in KEV since Sep 25, 2026

EPSS

2.1%

Percentile

81.2%

CVSS

8.8

CVE-2026-67279CISA KEVMEDIUM

Published in NVD Sep 5, 2026 · in KEV since Sep 25, 2026

EPSS

1.0%

Percentile

62.6%

CVSS

6.9

CVE-2026-71362CISA KEVCRITICAL

Published in NVD Aug 11, 2026 · in KEV since Sep 24, 2026 · EPSS unchanged since Oct 6, 2026

EPSS

87.5%

Percentile

99.8%

CVSS

9.1

CVE-2026-5430CISA KEVCRITICAL

Published in NVD Aug 6, 2026 · in KEV since Sep 24, 2026

EPSS

0.6%

Percentile

46.6%

CVSS

10.0

CVE-2026-93616CISA KEVCRITICAL

Published in NVD Sep 22, 2026 · in KEV since Sep 22, 2026

EPSS

19.7%

Percentile

97.3%

CVSS

9.8

CVE-2026-85102CISA KEVCRITICAL

Published in NVD Sep 9, 2026 · in KEV since Sep 22, 2026

EPSS

7.5%

Percentile

94.4%

CVSS

9.8

CVE-2026-94127CISA KEVCRITICAL

Published in NVD Sep 22, 2026 · in KEV since Sep 22, 2026

EPSS

2.2%

Percentile

82.2%

CVSS

9.3

CVE-2026-93952CISA KEVCRITICAL

Published in NVD Sep 22, 2026 · in KEV since Sep 22, 2026

EPSS

1.1%

Percentile

63.6%

CVSS

9.5

CVE-2026-7273CISA KEVHIGH

Published in NVD Jun 16, 2026 · in KEV since Sep 21, 2026

EPSS

2.5%

Percentile

84.3%

CVSS

8.8

CVE-2025-39682CISA KEVCRITICAL

Published in NVD Sep 5, 2025 · in KEV since Sep 18, 2026

EPSS

2.9%

Percentile

86.5%

CVSS

9.8

CVE-2025-39964CISA KEVHIGH

Published in NVD Oct 13, 2025 · in KEV since Sep 18, 2026

EPSS

1.3%

Percentile

69.1%

CVSS

7.8

CVE-2026-53266CISA KEVHIGH

Published in NVD Jun 25, 2026 · in KEV since Sep 18, 2026

EPSS

0.8%

Percentile

56.3%

CVSS

8.8

CVE-2026-76460CISA KEVCRITICAL

Published in NVD Sep 16, 2026 · in KEV since Sep 16, 2026

EPSS

14.0%

Percentile

96.5%

CVSS

10.0

CVE-2026-58704CISA KEVHIGH

Published in NVD Sep 15, 2026 · in KEV since Sep 16, 2026

EPSS

0.6%

Percentile

46.7%

CVSS

8.8

CVE-2026-87886CISA KEVHIGH

Published in NVD Sep 17, 2026 · in KEV since Sep 16, 2026

EPSS

0.2%

Percentile

13.1%

CVSS

7.8

CVE-2026-76461CISA KEVCRITICAL

Published in NVD Sep 14, 2026 · in KEV since Sep 14, 2026

EPSS

28.3%

Percentile

98.1%

CVSS

9.8

Outside KEV: highest EPSS probability

30 shown · 3,458 CVEs outside KEV have EPSS ≥ 50% in this snapshot. Order: EPSS, percentile and CVE id. A triage prediction, not proof of attack.

CVE-2014-3566LOW

Published in NVD Oct 15, 2014 · EPSS unchanged since Sep 19, 2026

EPSS

99.999%

Percentile

99.999%

CVSS

3.4

CVE-2021-45105MEDIUM

Published in NVD Dec 18, 2021 · EPSS unchanged since Aug 17, 2026

EPSS

99.999%

Percentile

99.99%

CVSS

5.9

CVE-2023-50387

No NVD record in Virtual Arena AI · EPSS unchanged since Sep 15, 2026

EPSS

99.99%

Percentile

99.98%

CVSS

—

CVE-2014-0195

Published in NVD Jun 5, 2014

EPSS

99.98%

Percentile

99.98%

CVSS

—

CVE-2014-3704

Published in NVD Oct 16, 2014 · EPSS unchanged since Sep 16, 2026

EPSS

99.97%

Percentile

99.98%

CVSS

—

CVE-2015-7297

Published in NVD Oct 29, 2015 · EPSS unchanged since Oct 4, 2026

EPSS

99.97%

Percentile

99.98%

CVSS

—

CVE-2012-1456

Published in NVD Mar 21, 2012 · EPSS unchanged since Oct 4, 2026

EPSS

99.9%

Percentile

99.97%

CVSS

—

CVE-2022-42889

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 4, 2026

EPSS

99.9%

Percentile

99.97%

CVSS

—

CVE-2019-0232

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 8, 2026

EPSS

99.9%

Percentile

99.97%

CVSS

—

CVE-2024-29825

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 2, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

—

CVE-2024-29826

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 4, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

—

CVE-2015-4000LOW

Published in NVD May 21, 2015 · EPSS unchanged since Oct 9, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

3.7

CVE-2024-29823

No NVD record in Virtual Arena AI · EPSS unchanged since Sep 22, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

—

CVE-2025-53771

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 10, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

—

CVE-2020-13379

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 3, 2026

EPSS

99.9%

Percentile

99.96%

CVSS

—

CVE-2017-12635CRITICAL

Published in NVD Nov 14, 2017 · EPSS unchanged since Sep 24, 2026

EPSS

99.8%

Percentile

99.96%

CVSS

9.8

CVE-2017-8917CRITICAL

Published in NVD May 17, 2017 · EPSS unchanged since Oct 6, 2026

EPSS

99.8%

Percentile

99.96%

CVSS

9.8

CVE-2012-1459

Published in NVD Mar 21, 2012

EPSS

99.8%

Percentile

99.96%

CVSS

—

CVE-2022-39952

No NVD record in Virtual Arena AI · EPSS unchanged since Sep 24, 2026

EPSS

99.8%

Percentile

99.96%

CVSS

—

CVE-2012-1446

Published in NVD Mar 21, 2012 · EPSS unchanged since Sep 26, 2026

EPSS

99.7%

Percentile

99.95%

CVSS

—

CVE-2008-2938

Published in NVD Aug 13, 2008 · EPSS unchanged since Sep 27, 2026

EPSS

99.7%

Percentile

99.95%

CVSS

—

CVE-2020-10220

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 2, 2026

EPSS

99.7%

Percentile

99.95%

CVSS

—

CVE-2023-27372

No NVD record in Virtual Arena AI · EPSS unchanged since Sep 9, 2026

EPSS

99.7%

Percentile

99.95%

CVSS

—

CVE-2012-1443

Published in NVD Mar 21, 2012 · EPSS unchanged since Oct 5, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2022-37061

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 9, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2020-14181

No NVD record in Virtual Arena AI · EPSS unchanged since Sep 22, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2020-16040

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 1, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2022-1471

No NVD record in Virtual Arena AI · EPSS unchanged since Oct 2, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2014-0094

Published in NVD Mar 11, 2014 · EPSS unchanged since Oct 7, 2026

EPSS

99.6%

Percentile

99.9%

CVSS

—

CVE-2024-6387HIGH

Published in NVD Jul 1, 2024 · EPSS unchanged since Oct 2, 2026

EPSS

99.5%

Percentile

99.9%

CVSS

8.1

How to prioritize CVEs →Known exploitation: CISA KEV →Security dashboard →