We matched 1,747 of the 1,748 KEV entries to their EPSS scores on 18 October 2026. The median score is 0.49 and 49.8 percent score 0.5 or higher. But 62 entries, 3.5 percent, score below 0.01. Known exploitation and a model estimate usually agree, and sometimes they do not.
Method
We downloaded the CISA KEV JSON feed (catalog version 2026.10.16, 1,748 entries) on 19 October 2026 and queried the public FIRST EPSS API for each CVE ID. Every score we received was dated 18 October 2026. One KEV entry returned no score. We report the raw score (a probability of exploitation activity in the next 30 days, per FIRST) and the percentile.
Limits: EPSS changes daily, so a re-run will differ. And a KEV entry is already exploited, so the scores here show how the model sees known-exploited flaws, not how well it predicts new ones.
What the numbers say
Share of KEV entries at or above each EPSS score:
| EPSS score | Entries | Share |
|---|---|---|
| 0.5 or higher | 870 | 49.8% |
| 0.1 or higher | 1,287 | 73.7% |
| 0.05 or higher | 1,412 | 80.8% |
| 0.01 or higher | 1,685 | 96.5% |
The median percentile is 0.989, and 84.3 percent of entries sit at or above the 90th percentile. Only 1.8 percent fall below the 50th. So for most KEV entries the model agrees that the flaw is high on the list.
By the year the entry was added, the median score drops for newer entries:
| Year added | Median EPSS | Share at or above 0.1 | Share below 0.01 |
|---|---|---|---|
| 2021 | 0.690 | 78.5% | 1.0% |
| 2022 | 0.559 | 79.3% | 0.5% |
| 2023 | 0.464 | 76.5% | 7.0% |
| 2024 | 0.666 | 81.2% | 3.8% |
| 2025 | 0.395 | 69.0% | 3.7% |
| 2026 | 0.146 | 53.2% | 10.3% |
For 2026 entries, 53.2 percent score 0.1 or higher, against about 77 to 81 percent for earlier years. One possible reading is that recent entries have had less time for scores to rise. We did not test that, so treat it as a question, not a finding.
How to use both signals
If a flaw is in KEV, act on it whatever the EPSS score says. Exploitation has been observed, so a low model score is not a reason to wait.
If a flaw is not in KEV, EPSS helps you rank the backlog, but a low score is not a safe harbour either. A score of 0.01 still leaves a real chance, and the 62 KEV entries below that line are proof that low scores and exploitation can coexist.
The order we suggest: KEV first, then high EPSS on reachable code on exposed systems, then the rest by severity and fix effort. For how to set a threshold, see how to choose an EPSS threshold.
Try it yourself
Open the demo and mark a finding as exploited, then watch where it moves in the list compared with a high severity finding that has no exploit signal.
Click through it at your own pace, or open it full screen.
Quick check
If a KEV entry has a low EPSS score, can I defer it?
No. KEV records observed exploitation. A low model score does not cancel that.
Why do 2026 entries score lower?
The data shows a lower median (0.146) for 2026 additions. We did not determine why, and the entries are also newer.
Sources
- CISA Known Exploited Vulnerabilities JSON feed, fetched 19 October 2026
- FIRST EPSS API, queried for scores dated 18 October 2026
Last reviewed: 19 October 2026.
