Of the 1,747 KEV CVEs that have an EPSS score, 62 (3.5%) score below 1%, even though each is known to have been exploited. 27 were added in 2026, and many are mobile or chipset flaws. A low EPSS score on a KEV entry does not lower its priority.
Method
We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16) and EPSS values dated 18 October 2026 for each CVE. One entry, CVE-2026-21589, had no EPSS value in our pull and is excluded. We counted entries with an EPSS probability below 0.01 and compared them by year added and vendor. EPSS estimates the probability that a published CVE is exploited in the next 30 days, so it predicts future activity and does not describe past exploitation.
How KEV entries distribute on EPSS
| EPSS probability | KEV entries at or above | Share of 1,747 |
|---|---|---|
| 0.01 | 1,685 | 96% |
| 0.05 | 1,412 | 81% |
| 0.10 | 1,287 | 74% |
| 0.50 | 870 | 50% |
| 0.90 | 471 | 27% |
The median EPSS probability for a KEV entry is 0.49. Half of the catalog is above 0.5, and a quarter above 0.9. The 62 below 1% are a small tail.
Who sits in the tail
By vendor, the low scorers include Android (8), Qualcomm (8), Samsung (8), Microsoft (6), Apple (6), Linux (3) and Google (3). Only one of the 62 is flagged as used in ransomware campaigns. By year added: 27 in 2026, 9 in 2025, 7 in 2024, 13 in 2023, 3 in 2022 and 3 in 2021.
Their EPSS percentiles run from about 0.13 to 0.61, against a median percentile of 0.99 for the full catalog. So these are among the lower scorers in absolute terms, not just in probability.
Why newer entries score lower
The median EPSS probability by year of addition falls from 0.69 for 2021 entries to 0.15 for 2026. Recent entries have had less time for the model to see signals, so the same flaw may score higher in a few weeks. We cannot confirm that from one snapshot.
What to do
- Never lower the priority of a KEV entry because EPSS is low. KEV records evidence that exploitation has happened. EPSS is a forecast.
- Use EPSS for the large pool of CVEs that are not in KEV, where you have no exploitation evidence.
- For the 62 low-scorers, ask the questions KEV cannot answer: is the product in your estate, is it exposed, and is a fix available?
- Re-check scores later, since they move.
Mobile and chipset entries often matter only if you manage devices, so for many organisations the answer to the first question is no.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare two findings and see how an exploited flag and a probability score can disagree.
Quick check
If EPSS is low, can I wait on a KEV entry?
No. KEV means exploitation has been observed. Decide by exposure and fix availability.
Why does EPSS look lower for 2026 entries?
The model has had less time to see signals for them. Scores can change as it does.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
- FIRST EPSS page, EPSS values for the KEV CVEs read for 18 October 2026.
Last reviewed: 19 October 2026.
