EPSS vs CVSS: How to Use Exploit Prediction Scores to Prioritize Patching When You Cannot Patch Everything

EPSS is a machine learning model trained on CVE characteristics and observed exploitation data from multiple threat intelligence sources including exploit databases, malware repositories, and honeypot networks. It outputs a probability score between 0 and 1 representing the likelihood that a CVE will be observed in exploitation activity within the next 30 days.

Key properties:

• Score updates daily: EPSS scores change as new exploitation activity is observed. A CVE that had a score of 0.02 last month may be 0.87 this week because a PoC was published.
• Score is not permanent: High EPSS scores often decay after the initial exploitation wave. Monitor score changes, not just current scores.
• Percentile is often more useful than raw score: EPSS provides both a score and a percentile. A score of 0.05 sounds low but if it represents the 94th percentile of all CVEs, it means 94% of all CVEs are less likely to be exploited.

The EPSS API:

import requests
# Get EPSS score for a specific CVE
cve_id = 'CVE-2024-21762'
response = requests.get(f'https://api.first.org/data/v1/epss?cve={cve_id}')
data = response.json()
print(data['data'][0])  # {'cve': 'CVE-2024-21762', 'epss': '0.96813', 'percentile': '0.99988', 'date': '2026-06-12'}

# Bulk fetch for a list of CVEs
curl 'https://api.first.org/data/v1/epss?cve=CVE-2024-21762,CVE-2024-30078,CVE-2023-44487'

Neither EPSS nor CVSS alone is sufficient. The composite approach:

Tier 1 (patch within 24 hours):

• CVE is in the CISA KEV catalog (confirmed active exploitation)
• Regardless of CVSS or EPSS score -- KEV means it is being exploited right now

Tier 2 (patch within 7 days):

• EPSS score above 0.5 (50% probability of exploitation in 30 days) AND
• CVSS score above 7.0 (High or Critical)
• This is the population of CVEs that are both severe and likely to be weaponized

Tier 3 (patch within 30 days per normal cycle):

• CVSS 9.0+ OR EPSS above 0.3, not in Tier 1 or 2

Tier 4 (patch in next scheduled maintenance):

• Everything else above CVSS 4.0

Practical implementation in Python:

import requests

def get_epss_score(cve_id):
    r = requests.get(f'https://api.first.org/data/v1/epss?cve={cve_id}')
    data = r.json().get('data', [])
    return float(data[0]['epss']) if data else 0.0

def prioritize_cve(cve_id, cvss_score, in_kev=False):
    epss = get_epss_score(cve_id)
    if in_kev:
        return 1, 'Tier 1 - Patch in 24h (KEV confirmed)'
    if epss >= 0.5 and cvss_score >= 7.0:
        return 2, f'Tier 2 - Patch in 7 days (EPSS={epss:.2f}, CVSS={cvss_score})'
    if cvss_score >= 9.0 or epss >= 0.3:
        return 3, f'Tier 3 - Patch in 30 days (EPSS={epss:.2f}, CVSS={cvss_score})'
    return 4, f'Tier 4 - Normal cycle (EPSS={epss:.2f}, CVSS={cvss_score})'

Most vulnerability scanners (Tenable, Qualys, Rapid7) export CVE lists in CSV or JSON. Enrich the scanner output with EPSS scores before generating your patch priority list.

Bulk EPSS enrichment script (Python):

import requests
import csv
import time

def enrich_cve_list(input_csv, output_csv):
    with open(input_csv) as f:
        rows = list(csv.DictReader(f))
    
    cve_ids = [row['CVE'] for row in rows if row.get('CVE')]
    
    # EPSS API supports up to 1000 CVEs per request
    epss_data = {}
    for i in range(0, len(cve_ids), 100):
        batch = cve_ids[i:i+100]
        cve_param = ','.join(batch)
        r = requests.get(f'https://api.first.org/data/v1/epss?cve={cve_param}')
        for item in r.json().get('data', []):
            epss_data[item['cve']] = (item['epss'], item['percentile'])
        time.sleep(0.5)  # Respect rate limits
    
    # Write enriched output
    with open(output_csv, 'w', newline='') as f:
        fieldnames = rows[0].keys() | {'EPSS_Score', 'EPSS_Percentile'}
        writer = csv.DictWriter(f, fieldnames=fieldnames)
        writer.writeheader()
        for row in rows:
            cve = row.get('CVE', '')
            epss, pct = epss_data.get(cve, ('0', '0'))
            row['EPSS_Score'] = epss
            row['EPSS_Percentile'] = pct
            writer.writerow(row)

enrich_cve_list('scanner_output.csv', 'enriched_vulns.csv')

After enrichment, sort by EPSS_Score descending within each CVSS severity band to get your priority queue.

A CVE that jumps from EPSS 0.02 to 0.85 in 48 hours indicates active weaponization -- a PoC was published, a campaign started, or it entered a widely-used exploit kit. Monitoring score changes is as important as monitoring current scores.

Daily delta monitoring:

import requests
from datetime import date, timedelta

def get_epss_on_date(cve_id, date_str):
    r = requests.get(f'https://api.first.org/data/v1/epss?cve={cve_id}&date={date_str}')
    data = r.json().get('data', [])
    return float(data[0]['epss']) if data else 0.0

def check_score_increase(cve_id, threshold=0.3):
    today = str(date.today())
    yesterday = str(date.today() - timedelta(days=1))
    current = get_epss_on_date(cve_id, today)
    previous = get_epss_on_date(cve_id, yesterday)
    delta = current - previous
    if delta >= threshold:
        print(f'ALERT: {cve_id} EPSS increased by {delta:.3f} (now {current:.3f})')
    return delta

Practical alert threshold: A CVE jumping 0.3 or more in a single day warrants immediate review. If that CVE affects systems in your environment and the new score exceeds 0.5, escalate to Tier 1 or Tier 2 treatment regardless of when it was originally scheduled for patching.