EPSS vs CVSS: What’s the Difference? [2026 Update]

Both the exploit prediction scoring system (EPSS) and the common vulnerability scoring system (CVSS) are used to rank vulnerabilities, but they differ significantly. CVSS measures how severe the impact of a vulnerability could be. EPSS predicts how likely it is that the vulnerability will be exploited in the next 30 days.

It’s worth noting that neither score gives a full picture on its own, and security teams tend to get the best results by using both, alongside the CISA Known Exploited Vulnerabilities (KEV) catalog data, to decide what to patch first.

This guide compares EPSS vs. CVSS, breaks down what each score measures, how they’re calculated, and how to combine them into a working vulnerability prioritization process, with real CVE examples so you can see the difference in practice. Here’s a TL;DR version:

Table of Contents

• EPSS vs CVSS: Key Differences
• What is CVSS: Prioritizing by Severity
• What is EPSS: Prioritizing by Likelihood of Exploitation
• Which Should You Use for Vulnerability Prioritization?
• Real-World Examples
• How Attaxion Can Help

EPSS vs CVSS: Key Differences

The table above covers the basics, but a few differences are worth discussing in more detail, since they shape how each score fits into a vulnerability management program.

• What they measure: CVSS scores technical severity, meaning how drastic the consequences could be if a vulnerability is exploited. Even though the specifications for CVSS 4.0 include exploitability metrics, it does not consider the actual threat landscape. EPSS scores probability, meaning how likely it is that a vulnerability would be exploited within the next 30 days. It does not take into account how severe the outcome of a successful exploitation would be for an organization (even though, obviously, malefactors do not usually exploit vulnerabilities that don’t give them the privileges that they are after).
• How the CVSS score and EPSS score are calculated: A CVSS score comes from a defined formula run through a calculator, with a human selecting each metric. You can find a calculator for all CVSS releases. For example, here’s a calculator for CVSS 4.0, and here’s one for CVSS 3.0, which is older, but still more widely used. If someone finds a previously unknown vulnerability, they can estimate its severity by using those calculators. In comparison, the EPSS score comes out of a machine learning model that’s trained on exploit data and recalculated automatically, without analysts manually selecting scoring metrics for each CVE.
• How often scores change: A CVSS Base Score is essentially a static severity score once it’s published — it usually doesn’t change, even though different numbering authorities can assign different scores to the same CVE, and NVD often recalculates CVSS for each CVE that is added to the database. What can change is the Threat score, which covers the existence and availability of the exploit, but the Base score remains the same. EPSS is different — for every CVE, the score updates daily as new threat data comes in. So, the EPSS score today for a certain vulnerability can look very different a week from now.

None of these differences makes one scoring system better than the other. It just means they measure different things, and a mature risk-based vulnerability management practice checks both before deciding what to patch first.

What is CVSS? Prioritizing by Severity

CVSS is a numerical score of a vulnerability’s technical severity, which is based on two factors: the potential consequences of exploitation and the technical conditions required to exploit it. 

CVSS assigns vulnerabilities a numerical score ranging from 0 to 10, with 10 being the most severe, and these are translated into a qualitative rating of low, medium, high, and critical. 

Vulnerabilities that allow arbitrary code execution are usually assigned the highest severity rating because attackers can run malicious code on the target system, potentially leading to full control of that system. 

FIRST and the National Infrastructure Advisory Council (NIAC) released the first version of CVSS in 2005, and FIRST has maintained the standard ever since. It’s gone through several revisions:

• CVSS v2.0 (2007): Widely adopted by scanning tools, but criticized for guidelines vague enough to produce inconsistent scores across organizations.
• CVSS v3.0 (2015): CVSS v2.0 was overhauled in 2012, and work on CVSS v3.0 began, but it wasn’t until 2015 that the newer version was officially released. This version introduced several improvements, such as enhanced granularity for metrics, a clearer definition of “scope,” and better consideration of attacker privileges and user interaction. 
• CVSS v3.1 (2019): In mid-2019, v3.1 was released to provide more detailed scoring guidance without any changes to the metrics or formula. CVSS v3.x is still widely adopted across many organizations.
• CVSS v4.0 (November 2023): The current version (as of July 2026)), which has new metrics and terminologies aimed at enhancing accuracy. It also made existing metrics more granular, improved user interaction classification, and expanded its scope to consider impacts on subsequent systems.

CVSS Base Score vs. Threat, Environmental, and Supplemental Metrics

CVSS v4.0 groups metrics into different categories:

• Supplemental metrics: Optional context that doesn’t change the numeric score, but is included alongside the score to help with decision-making.
• Base score: Captures the vulnerability’s intrinsic characteristics and stays fixed over time. Most public discussion of a CVE’s score refers to this category.
• Threat metrics: Account for factors that change, such as whether exploit code is publicly available.
• Environmental metrics: This category lets an organization adjust the score based on its own setup, such as compensating controls or how critical the affected asset is.

Every CVE in the Common Vulnerabilities and Exposures (CVE) database gets a Base score. Vulnerabilities without a CVE identifier can still be scored manually, using calculators from the National Institute of Standards and Technology (NIST) and FIRST.

Limitation: CVSS is most commonly used for publicly disclosed software vulnerabilities, especially those with CVE IDs, but the framework can also be applied manually when enough technical detail is available. It does not, by itself, account for asset criticality, real-world exploitation, business impact, or non-CVE exposure issues such as misconfigurations.

What is EPSS? Prioritizing by Likelihood of Exploitation

EPSS is a predictive scoring system that estimates the probability that a vulnerability will be exploited within the next 30 days. It runs on machine learning models trained on threat data pulled from exploit databases, malware repositories, and threat intelligence feeds, refreshed with real-time data as new exploit activity shows up. 

EPSS focuses on real-world exploitability, so security teams can prioritize by actual risk rather than potential impact. FIRST sometimes calls this approach Predictive Prioritization, since the whole point is forecasting what’s likely to be hit next instead of just cataloging what’s technically bad.

A group of researchers at FIRST built EPSS starting in 2020, and public daily scoring began in April 2021. It’s been updated several times since: version 2 in February 2022, version 3 in March 2023, and version 4 in March 2025. FIRST continues to maintain and refine the model.

Factors That Influence EPSS Scores

The EPSS model collects two types of data on a daily basis — vulnerability information and exploitation activity. These include the following data points:

• Vendor: The product and product provider affected by the vulnerability using the Common Platform Enumeration (CPE), obtained from the National Vulnerability Database (NVD).
• Age of the vulnerability: Number of days since the CVE was published in the MITRE CVE list.
• References: The MITRE CVE List and NVD provide various references with categorical labels (e.g., advisories, malware, exploit, patch).
• Normalized multiword expressions: This data is extracted from the description of the vulnerability in the MITRE CVE List.
• Common Weakness Enumeration (CWE): EPSS obtains the underlying security issue associated with the vulnerability from NVD.
• CVSS metrics: EPSS incorporates CVSS 3.x base vector metrics from NVD.
• The CVE’s presence on prominent security lists: EPSS identifies whether a CVE is listed or discussed on the CISA KEV catalog, Google Project Zero advisories, or Trend Micro’s Zero Day Initiative (ZDI), as these often indicate active exploitation or high researcher interest.
• Publicly available exploit code: The model checks platforms like Exploit-DB, GitHub, and Metasploit for any exploit code related to the vulnerability.
• Offensive security tools and scanners: EPSS considers whether the vulnerability is integrated into popular offensive security tools and scanners like Intrigue, sn1per, jaeles, and nuclei.

Limitation: EPSS only scores vulnerabilities with CVE identifiers, so it does not cover misconfigurations, exposed services, weak access controls, or issues that have not been publicly disclosed as CVEs. And when a vulnerability shows up in the CISA KEV catalog, meaning it’s confirmed to be under active attack, that confirmation always outranks the EPSS score. EPSS is most useful for the much larger set of vulnerabilities where there’s no confirmed exploitation yet, just a probability.

EPSS Percentile vs. EPSS Score

EPSS gives you two related but different numbers, and it’s important to understand how they differ to avoid mixing them up. 

• EPSS score: This is the raw probability (0 to 1) that a vulnerability will be exploited in the next 30 days. A score of 0.15 means there’s 15% chance of exploitation. 
• EPSS percentile: This measures how that score ranks against every other scored vulnerability. A percentile of 0.95 means the CVE scores higher than 95% of all CVEs in the dataset.

An EPSS score of 0.1 might not sound alarming on its own, but if it puts a vulnerability in the 88th percentile, that means it’s already riskier than the majority of CVEs FIRST tracks. 

Most teams use percentile for relative triage across a large backlog, and raw score for absolute thresholds. For example, teams may say that “anything above 0.90 EPSS score gets an emergency ticket.”

EPSS vs. CVSS: Which Should You Use for Vulnerability Prioritization?

Short answer: use both. 

Of all the vulnerability scoring systems available today, CVSS and EPSS are the two that most security teams use, and they’re built to work together, not compete. 

Security teams had been using CVSS as the primary tool for vulnerability assessment for almost two decades. However, its limitations in taking into account real-world threats led to the development of EPSS to address the main missing piece in CVSS ratings: the likelihood of a vulnerability actually being exploited. 

However, EPSS alone doesn’t provide a complete picture either, as it doesn’t fully account for the severity of the impact to an organization in case a vulnerability is exploited. While it considers the CVSS Base score, it doesn’t include other CVSS metrics that are more organization-specific. 

Therefore, the optimal approach for effective vulnerability prioritization is to integrate both CVSS and EPSS scores, with the highest priority ideally assigned to vulnerabilities that exhibit both a high CVSS score (indicating a severe potential impact) and a high EPSS score (indicating a high probability of exploitation).

To reiterate, CVSS tells you how bad a vulnerability could be if exploited, while EPSS tells you how likely that exploitation actually is. A vulnerability that scores high on both is your top priority. One that scores high on severity but low on exploit probability can usually wait.

A simple way to sort your patch queue:

• High CVSS + high EPSS: Patch now. Both signals agree that this is dangerous and likely to be exploited.
• High CVSS + low EPSS: Still worth fixing, but it can move down the queue behind more urgent items.
• Low or medium CVSS + high EPSS: Don’t ignore this just because the severity looks modest. Attackers may already be testing it.
• Confirmed in CISA KEV: treat as a priority regardless of CVSS or EPSS. Known exploitation in the wild outranks both scores.

One more layer worth adding once you’ve narrowed the list is asset criticality. A vulnerability with high CVSS and EPSS scores on a system with real business importance deserves a same-day fix. The same CVE on a decommissioned test box, much less so. Context about where a vulnerability lives on your attack surface is often what separates a true emergency from noise.

Beyond these scores, it’s also important to incorporate other threat intelligence sources, such as the CISA KEV catalog. After all, a vulnerability confirmed to be exploited in the wild warrants immediate attention regardless of its CVSS or EPSS score. 

Real-World Examples

Here’s how CVSS, EPSS, and KEV status play out on four real vulnerabilities.

How Attaxion Can Help

Attaxion is an agentless exposure management platform that helps security teams prioritize vulnerabilities by combining CVSS severity, EPSS exploit probability, and CISA KEV status with asset context. 

Attaxion also discovers all your external-facing assets automatically, providing visibility into previously unknown and vulnerable assets and allowing you to determine the business criticality of each vulnerable asset.

These combined data points — prioritization metrics and a complete asset catalog—serve as a strong foundation for well-informed risk-based vulnerability management.

Ready to see how Attaxion can help you prioritize vulnerabilities using CVSS, EPSS, and CISA KEV? Schedule a demo now.