EPSS from 1 Sep to 17 Oct 2026: 34 Big Drops, 23 of Them KEV CVEs

If your vulnerability policy reads EPSS once, at triage time, this post is for you. We compared the EPSS score of every CVE on 1 September 2026 with its score on 17 October 2026. Both files use the same model version, so the changes come from the inputs, not a model update.

Big moves were rare, but they were lopsided. 34 CVEs dropped by 0.5 or more, and 23 of those are in CISA's Known Exploited Vulnerabilities catalog. Only eight CVEs rose by 0.5 or more.

How we counted

The two EPSS daily files carry the same header model version, v2026.06.15, with score dates 2026-09-01T12:03:04Z and 2026-10-17T12:00:28Z. KEV is catalog version 2026.10.16. All were downloaded on 18 October 2026.

for day in 2026-09-01 2026-10-17; do
  curl -sSL -o "epss_$day.csv.gz" \
    "https://epss.empiricalsecurity.com/epss_scores-$day.csv.gz"
done
curl -sS -o kev.json \
  https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

import json, gzip, csv

kev = {v["cveID"]: v for v in json.load(open("kev.json"))["vulnerabilities"]}

def epss(day):
    with gzip.open(f"epss_{day}.csv.gz", "rt") as f:
        print(f.readline().strip())
        return {r["cve"]: float(r["epss"]) for r in csv.DictReader(f)}

a, b = epss("2026-09-01"), epss("2026-10-17")
both = set(a) & set(b)
print(len(a), len(b), "in both:", len(both), "new:", len(set(b) - set(a)))

def show(label, cves):
    print(label, len(cves), "of which KEV:", sum(c in kev for c in cves))

show("rose by 0.5 or more", [c for c in both if b[c] - a[c] >= 0.5])
show("fell by 0.5 or more", [c for c in both if a[c] - b[c] >= 0.5])
show("crossed up through 0.5", [c for c in both if a[c] < 0.5 <= b[c]])
show("crossed down through 0.5", [c for c in both if b[c] < 0.5 <= a[c]])
show("crossed up through 0.1", [c for c in both if a[c] < 0.1 <= b[c]])
show("crossed down through 0.1", [c for c in both if b[c] < 0.1 <= a[c]])

for c in sorted(both, key=lambda c: b[c] - a[c])[:6]:
    k = kev.get(c)
    print(c, a[c], b[c], k and (k["vendorProject"], k["product"], k["dateAdded"]))

The 1 September file scored 366,848 CVEs and the 17 October file scored 390,724. 366,809 appear in both, and that is the population for the comparisons below. 23,915 CVEs were new in October and 39 from September were no longer scored.

What's affected

The largest drops, all KEV entries except one:

The eight largest rises include PaperCut NG/MF CVE-2026-81578 (0.00771 to 0.85581) and CVE-2026-82078 (0.00926 to 0.63532), both added to KEV on 31 August, plus Adobe Commerce CVE-2026-71362 and Cisco FMC CVE-2026-20079, which joined KEV in September. The only non-KEV CVE among the eight is CVE-2026-19478.

How to check if you're exposed

The risk is a ticket that was deprioritized, or closed as "accepted," based on a score that has since changed. Or the reverse: a CVE you rushed because of a 0.99 score that now reads 0.03, which can make an open ticket look like it no longer needs attention.

Export the CVE and the EPSS score you recorded at triage, then compare with today:

curl -sSL -o epss_today.csv.gz \
  https://epss.empiricalsecurity.com/epss_scores-current.csv.gz

# triage.csv has two columns: cve,epss_at_triage
python3 -I -c '
import csv, gzip
with gzip.open("epss_today.csv.gz", "rt") as f:
    f.readline()
    now = {r["cve"]: float(r["epss"]) for r in csv.DictReader(f)}
for r in csv.DictReader(open("triage.csv")):
    then, cur = float(r["epss_at_triage"]), now.get(r["cve"])
    if cur is not None and abs(cur - then) >= 0.3:
        print(r["cve"], then, "->", cur)
'

What to do now

1. Never close a KEV ticket on a falling EPSS score. 23 KEV CVEs dropped by 0.5 or more in six weeks. KEV status doesn't expire, and the systems that were exploitable still are.
2. Store the triage-time score. Without it you can't tell whether a decision was made on old data.
3. Recompute priority on a schedule. A weekly job that re-reads EPSS and KEV and flags any ticket whose priority band changed is cheap.
4. Treat a large rise as a fresh trigger. The 54 CVEs that crossed up through 0.5 should reopen any "accepted risk" decisions made below that line.
5. Read EPSS as a 30-day forecast. FIRST describes EPSS as estimating "the probability that a published CVE will be exploited in the wild in the next 30 days." A drop says the near-term signals cooled, not that the bug got safer.

Why it matters

EPSS is designed to move. That is a feature for ordering a backlog, and a trap if a single number gets copied into a ticket and frozen. The drops in this window are concentrated in exactly the CVEs where being wrong hurts most: ones with confirmed exploitation.

A Linux kernel CVE going from 0.99907 to 0.03437 in six weeks doesn't mean the kernel on your hosts is fixed. It means the model sees less activity right now. Patch state is a separate question, and it should be tracked separately.

Try it yourself

Pick your ten oldest open tickets that cite an EPSS score. Look each one up in today's file. Count how many would land in a different priority band today. The demo below shows continuous monitoring that re-evaluates findings as new data arrives.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• EPSS daily scores file for 1 September 2026
• EPSS daily scores file for 17 October 2026
• FIRST: Exploit Prediction Scoring System (EPSS)
• CISA Known Exploited Vulnerabilities catalog, JSON feed