EPSS gives every published CVE a daily probability of exploitation in the next 30 days, and the API behind it needs no key. On 16 October 2026 we looked up three CVEs that CISA had just added to its KEV catalog, and their scores ranged from under one percent to nearly thirteen.
That spread is the point. KEV tells you exploitation has happened somewhere. EPSS tells you how likely it is to reach more targets soon.
What's affected
The endpoint is https://api.first.org/data/v1/epss. It returns three fields per CVE: epss (a 0 to 1 probability), percentile (rank against all scored CVEs) and date (the scoring day). Results for 16 October 2026:
| CVE | Product | EPSS | Percentile |
|---|---|---|---|
| CVE-2026-21589 | Atlassian multiple products | 0.12711 | 0.96225 |
| CVE-2026-0322 | PAN-OS | 0.01215 | 0.68064 |
| CVE-2026-102764 | BeyondTrust Remote Support | 0.00601 | 0.47647 |
What to do now
- Look up one or several CVEs with a comma separated list:
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2026-21589,CVE-2026-0322,CVE-2026-102764" | jq '.data[]'
- Read the score as a probability. 0.127 means roughly a 12.7 percent chance of exploitation activity in the next 30 days.
- Use the percentile for ranking. A score of 0.012 sits at the 68th percentile because most CVEs score far lower.
- See the highest scoring CVEs overall, which the API orders on request:
curl -s "https://api.first.org/data/v1/epss?order=!epss&limit=3" | jq -c '.data[]'
- Pull history for a trend with
scope=time-series. For CVE-2026-0322 it returned a score of 0.01076 on 15 October and 0.01215 on 16 October. - Never use EPSS alone for a KEV entry. A low score on a KEV CVE does not lower its due date.
Try it yourself
Run the first command with two CVEs from your own latest scan, then check whether the order your scanner gives matches the order EPSS gives.
Click through it at your own pace, or open it full screen.
Quick check
An EPSS of 0.006 on a KEV entry: can you defer the patch?
No. KEV means exploitation is already observed, and the due date stands regardless of the EPSS score.
