What it means
EPSS is a forecast about exploitation activity for a published vulnerability. It estimates the probability that exploitation will be observed in the wild during the next thirty days. A score of 0.08 represents an eight percent probability under the model, not eight percent of your systems being compromised. A percentile is different: it describes where the score ranks among other scored vulnerabilities. EPSS does not describe the consequences of exploitation or your environment’s defenses, and it should be recorded with its date because estimates change.
The idea at a glance / Vulnerabilities
Separate forecast probability from relative ranking.
Read two different fields from one dated FIRST EPSS record: an estimated probability and its relative rank.
This is a fixed historical FIRST EPSS snapshot for CVE-2021-45105 on 2025-03-15. The API reports epss 0.950760000 and percentile 0.995120000. The original thirty-day forecast window has ended. The figure does not display today’s score or measure exploitation that actually followed.
READ THE PICTURE
Read the evidence and its limits
In this historical record, 0.95076 means a 95.076% model estimate of observed exploitation activity over the following thirty days. The 99.512th percentile describes relative ranking among scored vulnerabilities on that date. It is not a second probability or a local compromise rate.
Keep in mindNeither field supplies local deployment, defenses, consequences, or an organization’s chance of compromise. Ranking is relative to that date’s scored population. The API’s version field is not a model version. Do not substitute a historical estimate for current data or known exploitation evidence.
Read the complete example
- Read the evidence and its limits. In this historical record, 0.95076 means a 95.076% model estimate of observed exploitation activity over the following thirty days. The 99.512th percentile describes relative ranking among scored vulnerabilities on that date. It is not a second probability or a local compromise rate. The selected FIRST API response names CVE-2021-45105 and date 2025-03-15. This is a different Log4j2 issue from CVE-2021-44228; do not transfer another CVE’s score or KEV entry to it. Multiplying the epss field by 100 gives 95.076%. It estimates whether exploitation activity associated with the vulnerability will be detected, recorded, and shared by the model’s data partners in the wild during the next thirty days, rather than whether a particular installation will be compromised. The percentile field 0.99512 expresses a relative score rank, the 99.512th percentile, in that day’s scored population. It does not predict how many of your devices will be attacked or how severe an outcome would be. FIRST generates dated estimates daily; observations and model changes can affect later estimates. The saved API response identifies API version 1.0 but does not identify the scoring model revision; this illustration does not infer one. No later exploitation outcome, local applicability check, prioritization decision, or repair is recorded here.
Neither field supplies local deployment, defenses, consequences, or an organization’s chance of compromise. Ranking is relative to that date’s scored population. The API’s version field is not a model version. Do not substitute a historical estimate for current data or known exploitation evidence.
Diagram references: FIRST: EPSS probability and percentile · FIRST: Using EPSS · FIRST: EPSS snapshot for 2025-03-15
AN ILLUSTRATIVE SCENARIO
Two fields in one historical forecast
FIRST’s 2025-03-15 record for CVE-2021-45105 reports epss 0.950760000 and percentile 0.995120000. The first is a 95.076% estimate of observed exploitation activity in the following thirty days; the second gives the 99.512th percentile in that scored population. Neither is a local compromise rate. That forecast window has ended, and the example supplies no observed outcome. For a real queue, obtain a current dated estimate, check the correct CVE, and combine it with known exploitation and relevant asset context.
Put it to work
- Match findings to the correct CVE identifiers and obtain current EPSS probabilities. Keep the scoring date and distinguish the probability field from its ranking percentile.
- Use the forecast alongside known exploitation, technical severity, exposure, and asset importance. Decide and document how those separate inputs affect your remediation queue.
- Revisit priorities as forecasts, advisories, and your environment change. Keep an exception process for important vulnerabilities that a simple numerical threshold would miss.
How to check your work
Take a sample finding and explain the probability, percentile, and date in plain language. Check that the queue still prioritizes confirmed exploitation and critical local exposure instead of allowing the forecast to overrule stronger evidence.
Connect the ideas
- CVE
A public identifier for a specific disclosed vulnerability record.
- CVSS
FIRST’s method for describing characteristics and technical severity of a vulnerability, not a full remediation order.
- KEV
CISA’s catalog of vulnerabilities with evidence of exploitation in the wild.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.