Risk composition shifts outside KEV: CWE-119 is 3.09× more prevalent

On the Oct 11, 2026 EPSS snapshot, the NVD × FIRST EPSS × CISA KEV intersection produces two distinct review bands: 673 HIGH/CRITICAL CVEs are already in KEV, which records known exploitation; another 422 are HIGH/CRITICAL, outside KEV and have EPSS >= 50%. The bands are not equivalent: EPSS is an estimated probability, not proof of exploitation. Separately, NVD published 13.6K CVEs in 30 days, +2.0% versus the prior 30 days. CWE-119 represents 21.2% of the HIGH/CRITICAL EPSS >= 50% non-KEV band versus 6.9% in KEV (3.09×; FDR q <0.0001). This is a composition difference, not a forecast of future KEV inclusion.