On 2026-10-08, the median EPSS score of the 1,739 vulnerabilities in the CISA Known Exploited Vulnerabilities (KEV) catalog was 0.49, using the FIRST EPSS daily file (model v2026.06.15). 1,283 entries scored 0.1 or higher, 866 scored 0.5 or higher and 466 scored 0.9 or higher. Only 60 scored below 0.01.
- 0.49Median EPSS score of the 1,739 KEV entriesSource: FIRST EPSS daily file, model v2026.06.15, score date 2026-10-08, with CISA KEV catalog version 2026.10.08
- 1,283KEV entries at or above 0.1Source: FIRST EPSS daily file, model v2026.06.15, score date 2026-10-08, with CISA KEV catalog version 2026.10.08
- 866KEV entries at or above 0.5Source: FIRST EPSS daily file, model v2026.06.15, score date 2026-10-08, with CISA KEV catalog version 2026.10.08
- 60KEV entries below 0.01Source: FIRST EPSS daily file, model v2026.06.15, score date 2026-10-08, with CISA KEV catalog version 2026.10.08
What does an EPSS score tell you?
EPSS is a model published by FIRST. For each published CVE it gives a number from 0 to 1. FIRST describes that number as the probability that the CVE will be exploited in the wild in the next 30 days. The file is refreshed every day.
That makes it a prediction made on one date. It is not a record of what happened in the past. KEV works differently: it is a list of CVEs that CISA has judged to be exploited in the wild. For background on both signals, see the hub pages on EPSS and known exploited vulnerabilities. Our earlier note on combining CVSS, EPSS and KEV signals covers how teams use them together.
Method: how did we join the two datasets?
We downloaded the FIRST EPSS file epss_scores-current.csv.gz on 2026-10-09. Its header reads model v2026.06.15 and score date 2026-10-08. It holds scores for 384,534 CVEs. We also used the CISA KEV catalog, version 2026.10.08, with 1,739 entries.
We matched the two files by CVE identifier. Every one of the 1,739 KEV CVEs has an EPSS score, so none were dropped. Then we counted entries at or above four thresholds: 0.01, 0.1, 0.5 and 0.9. We did the same for all 384,534 scored CVEs, and took the median score of the KEV entries.
Where do KEV entries sit on the scale?
The median is 0.49083, so about half of the catalog scores above roughly 0.49 and half below. The spread is wide. Counts of KEV entries at or above each threshold:
| EPSS threshold | KEV entries at or above |
|---|---|
| 0.01 | 1,679 |
| 0.1 | 1,283 |
| 0.5 | 866 |
| 0.9 | 466 |
Most of the catalog sits at 0.1 or above, and 466 entries are at 0.9 or above. At the other end, 60 KEV entries score below 0.01. Those are CVEs that CISA lists as exploited, yet the model today gives a very low chance of exploitation in the next 30 days.
How many scored CVEs are in KEV at each threshold?
The reverse view starts from all 384,534 scored CVEs. At 0.1 or higher there are 17,298. At 0.5 or higher there are 4,322, and at 0.9 or higher there are 797. At 0.01 or higher there are 147,403. Every KEV entry at or above 0.1, 0.5 and 0.9 is also counted in those totals.
| EPSS threshold | All scored CVEs | In KEV |
|---|---|---|
| 0.1 | 17,298 | 1,283 |
| 0.5 | 4,322 | 866 |
| 0.9 | 797 | 466 |
From these counts we derived three shares. KEV holds 7.4% of the CVEs at 0.1 or higher (1,283 of 17,298). It holds 20.0% of those at 0.5 or higher (866 of 4,322). It holds 58.5% of those at 0.9 or higher (466 of 797). So most CVEs at or above 0.5 are not in KEV: 866 of 4,322. Only in the top band, 0.9 and above, are most of them listed.
This does not show that the unlisted CVEs are exploited or safe. KEV needs evidence that CISA accepts, and a CVE can score high without being listed. The data cannot tell us, for any single CVE, whether the score or the listing is closer to the truth.
Why do recent entries score lower?
The 686 entries added to KEV from 2024 to 2026 have a median EPSS score of 0.31405, lower than the 0.49083 for the whole catalog. A gap like this is easy to over-read. EPSS is a prediction as of one date, and an old listing and a recent one are scored on the same day, 2026-10-08.
The score reflects activity the model sees now. It is not the activity at the time of listing. An old listing and a recent one are measured against the same current signal, so the score is not a like-for-like comparison of the two groups. We did not test why the medians differ, so we do not offer a cause. For the timing side of the same entries, see days from CVE publication to KEV listing.
One more split in the data: KEV entries flagged with known ransomware campaign use have a median of 0.86633. The others have a median of 0.39337. We cover the flagged group in ransomware-linked KEV vulnerabilities. For the wider process around such scores, see vulnerability management.
In plain terms, the catalog is not a flat block of top-scoring CVEs. It spans the whole range, from 466 entries at 0.9 or above down to 60 below 0.01. A score alone does not sort a KEV entry into urgent or not urgent, and a KEV listing alone does not say how the model rates it today.
Limits
- EPSS is a prediction made today. It is not a record of past exploitation.
- A low score on a KEV entry does not make the entry safe. It was listed because CISA had evidence of exploitation.
- The file moves daily. Our counts are for the score date 2026-10-08 and model v2026.06.15, and a later file will give different numbers.
- Thresholds of 0.01, 0.1, 0.5 and 0.9 are our choice, not a FIRST recommendation.
- We show counts and medians. They describe how the two datasets overlap and do not show cause.
Questions to ask of your own data: which of the 60 low-scoring KEV entries are present in your environment, and which high-scoring CVEs outside KEV are?
For the deadlines CISA attaches to listed entries, see KEV due-date windows and pace of additions.