Research report · Vulnerability research and technical analysis
Severity is not a schedule: how well CVSS and EPSS predicted real exploitation
We tested the two most widely used prioritisation scores against 201,099 vulnerabilities and every confirmed exploitation from February 2024 to November 2026. Neither is enough on its own, and most exploitation outpaces both.
1Executive summary
Security teams rank vulnerabilities to decide what to fix first. The two most common scores are CVSS, which rates how severe a flaw is, and EPSS, which estimates how likely it is to be exploited. Many teams now treat EPSS as the better guide. We tested both against what actually happened.
We took every vulnerability with a 2023 to 2026 identifier in the US National Vulnerability Database (NVD) and, at eleven quarterly dates, ranked the unpatched backlog the way a defender could have on that day. We then checked which vulnerabilities the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed as exploited over the following quarter. The answer is less tidy than either camp suggests, and the largest finding is about timing rather than scores.
Key findings
Most exploitation involves vulnerabilities too new to have been on any ranked list. 69.2% of the vulnerabilities confirmed as exploited in each quarter were published during that same quarter, and over the year to November 2026 the figure was 85.7%.
Severity concentrates exploitation but is a blunt filter. Critical and High ratings cover 46.7% of all vulnerabilities and 85.8% of those exploited, yet 98.5% of Critical vulnerabilities have not been exploited.
At equal effort, EPSS did not beat the CVSS score assigned at publication. Fixing the 10% of the backlog rated Critical would have caught 43.6% of later exploitation; fixing the same number of vulnerabilities with the highest EPSS scores would have caught 38.5%. Results varied by EPSS model version.
A high EPSS score is the most efficient signal, and the two scores work best together. "Critical, or EPSS of 10% or more" flagged 11.1% of the backlog and caught 53.1% of later exploitation, more than either score alone at similar effort.
Relying on NVD’s own scores is no longer safe. NVD has scored only 15.3% of 2026 vulnerabilities itself, and 44.0% of exploited vulnerabilities in our data have no NVD score at all. Using NVD scores alone, Critical or High would have caught 54.7% of later exploitation instead of 86.6%.
What this means
- Boards and executives
- A good prioritisation score is not a substitute for speed. Ask how quickly the organisation acts on a newly published, actively exploited vulnerability in an internet-facing system, not only how the backlog is ranked.
- Security leaders
- Run two processes: a fast lane for new vulnerabilities in exposed products and for anything confirmed exploited, and a ranked backlog that combines CVSS and EPSS. Check that your tools take scores from the vendor or CNA, not only from NVD.
- Engineering and operations
- Expect most urgent patches to concern vulnerabilities published days ago. Keep the ability to patch or mitigate internet-facing systems outside the normal monthly cycle.
2Scope and questions
Research questions
- How well do CVSS severity ratings and EPSS scores, as known at the time, identify the vulnerabilities that are later confirmed as exploited?
- How much exploitation could any ranking of the existing backlog have anticipated?
- How should an organisation with limited capacity combine these signals?
In scope
- 201,099 vulnerabilities with CVE identifiers from 2023 to 2026 in the NVD, excluding 4,859 rejected records
- Confirmed exploitation as recorded in the CISA KEV catalogue, version 2026.11.10
- EPSS scores published by FIRST on eleven quarterly dates from 10 February 2024 to 10 August 2026, covering three EPSS model versions
Out of scope
- Vulnerabilities with identifiers from 2022 or earlier, which make up about a fifth of recent KEV additions (see report EFF-RR-2026-001)
- Commercial threat-intelligence and vendor risk scores, which are not public and could not be tested
- How many systems or patches each vulnerability affects in a particular organisation
3Methodology
We read all four NVD yearly feeds for 2023 to 2026 (retrieved 11 November 2026; each matched its published SHA-256 checksum), the KEV catalogue, and the EPSS score file for each test date. For CVSS we used the version 3.x base score, banded in the standard way: Critical 9.0 to 10, High 7.0 to 8.9, Medium 4.0 to 6.9 and Low 0.1 to 3.9.
A fair test must use only what a defender knew at the time. FIRST publishes a new EPSS file every day, so we used the file published on each test date. For CVSS we preferred the score set by the CVE Numbering Authority (CNA), usually the vendor, which is normally published with the vulnerability. NVD often adds its own score later and has said it prioritises exploited vulnerabilities in its analysis, so using NVD scores would have favoured CVSS with hindsight. We show the NVD-only result separately.
At each of the eleven quarterly dates, the backlog was every vulnerability published by that date, not yet in KEV and with an EPSS score that day. We applied each prioritisation rule to the backlog and counted how many of the vulnerabilities CISA added to KEV before the next date the rule had flagged. Effort is the share of the backlog a rule flags; coverage is the share of later exploitation it caught. Results are summed over all eleven windows, which together contain 179 exploited vulnerabilities.
Sources
| Source | How it was used | Reliability |
|---|---|---|
| NIST National Vulnerability Database, CVE 2.0 yearly feeds, 2023 to 2026 | Every vulnerability’s identifier, publication date and CVSS v3.x scores from NVD and from the CNA. | Authoritative primary source. NVD’s own scoring is incomplete for recent years. |
| CISA Known Exploited Vulnerabilities catalogue, version 2026.11.10 | The outcome: which vulnerabilities were confirmed as exploited, and when they were added. | Authoritative primary source with a high evidence threshold. |
| FIRST Exploit Prediction Scoring System, daily score files | EPSS scores as published on each test date, from models v2023.03.01, v2025.03.14 and v2026.06.15. | Authoritative primary source for the scores. Each daily file records the scores published that day. |
Review
- Author review: Fahad Imran, author
Data availability
4Findings
Finding 1
Most exploitation outruns any ranked backlog
High confidence
Across the eleven quarterly windows, CISA confirmed exploitation of 582 vulnerabilities with 2023 to 2026 identifiers. Only 179 (30.8%) were already published when the window began and could have been on a ranked list. The other 403 (69.2%) were published during the window itself.
Over a single year the gap is wider. Of the 287 such vulnerabilities confirmed as exploited between 10 November 2025 and 10 November 2026, 246 (85.7%) had not been published on 10 November 2025.
This changes what prioritisation is for. Ranking the backlog well matters, but most urgent work arrives as newly published vulnerabilities that are exploited within days, as report EFF-RR-2026-001 also found. For these, EPSS has little history to work with, while the CNA’s severity score is available at once: 215 of the 246 (87.4%) were rated Critical or High.
| Period | Already published | Published in window | Share new |
|---|---|---|---|
| Eleven quarterly windows, Feb 2024 to Nov 2026 | 179 | 403 | 69.2% |
| One year, Nov 2025 to Nov 2026 | 41 | 246 | 85.7% |
Base: vulnerabilities with 2023 to 2026 CVE identifiers added to KEV during each window. Source: NVD CVE 2.0 feeds retrieved 11 November 2026; CISA KEV version 2026.11.10.
Finding 2
Severity concentrates exploitation, but most severe flaws are never exploited
High confidence
Of the 201,099 vulnerabilities in our data, 727 (0.36%) are in the KEV catalogue. Higher severity does mean higher risk: 1.48% of Critical vulnerabilities have been exploited, compared with 0.45% of High and 0.11% of Medium.
As a filter, though, severity is blunt. Critical and High together account for 46.7% of all vulnerabilities, so “fix everything Critical and High” is roughly half the list. It catches 85.8% of exploited vulnerabilities, but 98.5% of Critical vulnerabilities have not been exploited, and 101 exploited vulnerabilities (13.9%) were rated only Medium or Low.
| CVSS v3 severity | Share of all vulnerabilities | Share of exploited | Exploited within band |
|---|---|---|---|
| Critical (9.0–10) | 9.8% | 40.2% | 1.48% |
| High (7.0–8.9) | 36.9% | 45.7% | 0.45% |
| Medium (4.0–6.9) | 43.0% | 13.3% | 0.11% |
| Low (0.1–3.9) | 4.2% | 0.6% | 0.05% |
| No CVSS v3 score | 6.1% | 0.3% | 0.02% |
| All (201,099 and 727) | 100% | 100% | 0.36% |
Base: 201,099 non-rejected CVEs with 2023 to 2026 identifiers, of which 727 are in KEV. CNA score used where present, otherwise NVD. Source: NVD CVE 2.0 feeds retrieved 11 November 2026; CISA KEV version 2026.11.10.
Finding 3
At equal effort, EPSS did not outperform publication-time CVSS
Moderate confidence
The fairest comparison holds effort constant. At each test date we counted how many backlog vulnerabilities were rated Critical, then took the same number with the highest EPSS scores. Summed over the eleven windows, Critical caught 78 of the 179 later-exploited vulnerabilities (43.6%) and the EPSS list caught 69 (38.5%). At the larger effort of Critical or High, about 45% of the backlog, CVSS caught 86.6% and the matching EPSS list 65.4%.
The result depends on the EPSS model. Under the 2025 model (five windows, 93 exploited vulnerabilities), EPSS caught 40 against 35 for Critical. Under the 2023 model (five windows, 59) it caught 19 against 30, and under the 2026 model (one window, 27) 10 against 13. The numbers in each period are small, so we do not read much into any one of them.
This does not mean EPSS fails at its own task. EPSS estimates the probability of any exploitation activity in the next 30 days, as seen in FIRST’s data sources. Our outcome is narrower: confirmation by CISA within about 90 days. What it does mean is that EPSS is not a straightforward replacement for severity, as it is sometimes presented.
Base: 179 vulnerabilities added to KEV in eleven quarterly windows from 10 February 2024 to 10 November 2026, out of 884,547 backlog entries summed across windows. Source: NVD CVE 2.0 feeds; CISA KEV version 2026.11.10; FIRST EPSS daily files.
Finding 4
A high EPSS score is the most efficient signal, and works best alongside severity
Moderate confidence
EPSS is at its best at the top of its scale. Only 1.7% of the backlog had an EPSS score of 10% or more, yet that small group contained 23.5% of later exploitation: 2.7 exploited vulnerabilities for every 1,000 flagged, three times the rate for Critical (0.9 per 1,000).
Adding that group to the Critical list gives the best balance we tested. “Critical, or EPSS of 10% or more” flagged 11.1% of the backlog and caught 53.1% of later exploitation, against 43.6% for Critical alone at 10.0% effort. Each signal catches vulnerabilities the other misses.
Some exploitation is invisible to both. 21 of the 179 (11.7%) were rated only Medium or Low and had EPSS scores below 1%. For these, the only useful warnings are exploitation reports themselves and knowledge of which products are exposed.
| Rule | Backlog flagged | Exploitation caught | Per 1,000 flagged |
|---|---|---|---|
| EPSS 10% or more | 1.7% | 23.5% | 2.7 |
| EPSS 1% or more | 7.1% | 34.1% | 1.0 |
| CVSS Critical | 10.0% | 43.6% | 0.9 |
| CVSS Critical, or EPSS 10% or more | 11.1% | 53.1% | 1.0 |
| CVSS Critical or High | 45.5% | 86.6% | 0.4 |
Base: 179 exploited vulnerabilities and 884,547 backlog entries across eleven quarterly windows. Source: NVD CVE 2.0 feeds; CISA KEV version 2026.11.10; FIRST EPSS daily files.
Finding 5
NVD’s own scores now cover a minority of vulnerabilities
High confidence
NVD has scored 36.2% of the vulnerabilities in our data itself. The share falls each year, from 83.8% of 2023 identifiers to 15.3% of 2026 identifiers. Most of the gap is filled by scores from CNAs: 89.8% of 2026 vulnerabilities have a CVSS v3 score from one source or the other.
The gap matters most where it hurts. 320 of the 727 exploited vulnerabilities (44.0%) have no NVD score. A process that takes severity only from NVD would have flagged Critical or High for 30.4% of the backlog and caught 54.7% of later exploitation, compared with 86.6% using CNA scores. It is worth confirming which source a scanner or ticketing system uses.
Base: 201,099 non-rejected CVEs (30,669 for 2023, 38,502 for 2024, 43,708 for 2025, 88,220 for 2026). Source: NVD CVE 2.0 feeds retrieved 11 November 2026.
5Recommendations
Recommendations are ordered by priority. Effort is a broad estimate for a mid-sized organisation; your own will depend on what is already in place.
| # | Recommendation | Owner | Priority | Effort | Framework reference |
|---|---|---|---|---|---|
| 1 | Create a fast lane for newly published vulnerabilities rated Critical or High in internet-facing or business-critical products: assess within two working days and patch or mitigate as soon as exploitation is reported. | CISO with IT operations | High | Medium | NIST CSF 2.0 ID.RA-08 CIS Controls v8.1 7.2 |
| 2 | Treat any vulnerability in the KEV catalogue that affects you as urgent regardless of its scores. | Vulnerability management | High | Low | NIST CSF 2.0 ID.RA-01 CIS Controls v8.1 7.7 |
| 3 | Check where your tools take CVSS scores from, and make sure CNA and vendor scores are used when NVD has none. | Vulnerability management | High | Low | NIST CSF 2.0 ID.RA-08 |
| 4 | Rank the backlog with both signals: patch next anything rated Critical or with an EPSS score of 10% or more, and refresh the list at least weekly because EPSS changes daily. | Vulnerability management | Medium | Low | NIST CSF 2.0 ID.RA-05 CIS Controls v8.1 7.2 |
| 5 | Raise the priority of Medium and Low vulnerabilities in products exposed to the internet rather than excluding them by score. | Security architecture | Medium | Medium | NIST CSF 2.0 ID.RA-05 |
| 6 | Measure the process against reality: for each KEV addition that affects you, record whether it was already in the patch queue and how long remediation took. | CISO | Medium | Low | NIST CSF 2.0 ID.IM-01 |
6Limitations
- The outcome is confirmation in the KEV catalogue. EPSS is designed to predict a broader outcome, any exploitation activity within 30 days as seen in FIRST’s data sources, so this test measures how well each score anticipates KEV additions, not how well EPSS meets its own design goal.
- We treat the CNA score as the score known at publication. CNAs usually publish it with the vulnerability, but the feeds do not record when each score was added or changed, so some scores may have been set later.
- Only vulnerabilities with 2023 to 2026 identifiers are included. Older vulnerabilities still account for a meaningful share of exploitation and are outside this test.
- Effort is counted in vulnerabilities across all products, not in patches or systems. An organisation’s real effort depends on which products it runs, and its own exposure matters more than these global shares.
- The test windows contain 179 exploited vulnerabilities in total, and the comparisons by EPSS model rest on 27 to 93 each. Differences of a few points should not be over-read.
- This report was reviewed by its author and has not yet been independently peer reviewed. We welcome corrections and will record them in the version history.
7How to read this report
Each finding carries a confidence level, which describes the quality of the evidence behind it. Where we estimate likelihood, we use fixed terms so that “likely” means the same thing every time.
- High confidence
- Based on good-quality information from several independent sources, or on a complete dataset. A high-confidence judgement can still be wrong.
- Moderate confidence
- Based on credible information, but with gaps, a limited sample or more than one plausible interpretation.
- Low confidence
- Based on scarce, fragmented or single-source information. Treat it as something to watch, not as the sole basis for a major decision.
| Term | Probability |
|---|---|
| Almost no chance | 1–5% |
| Very unlikely | 5–20% |
| Unlikely | 20–45% |
| Roughly even chance | 45–55% |
| Likely | 55–80% |
| Very likely | 80–95% |
| Almost certain | 95–99% |
8References
- National Institute of Standards and Technology. National Vulnerability Database data feeds (CVE 2.0). Retrieved 11 November 2026. https://nvd.nist.gov/vuln/data-feeds
- Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog, version 2026.11.10. Retrieved 11 November 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST. Exploit Prediction Scoring System (EPSS). https://www.first.org/epss/
- FIRST. Probability, percentiles and binning: how to understand and interpret EPSS scores. https://www.first.org/epss/articles/prob_percentile_bins
- Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I. and Roytman, M. (2021). Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice, 2(3). DOI 10.1145/3436242.
- FIRST. Common Vulnerability Scoring System v3.1: Specification Document. https://www.first.org/cvss/v3.1/specification-document
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29
- Center for Internet Security. CIS Critical Security Controls, version 8.1. https://www.cisecurity.org/controls/v8-1
- Imran, F. (2026). Exploited at the edge: what four years of confirmed attacks say about patching priorities (Report EFF-RR-2026-001). Effycace Solutions Pte Ltd. /research/reports/exploited-vulnerabilities-2023-2026/
9About this report
- Author
- Fahad Imran, Effycace Solutions
- Funding and interests
- This report was funded by Effycace Solutions. FIRST, CISA and NIST did not sponsor, review or approve it.
- Distribution
- TLP:CLEAR This report may be shared freely, with attribution.
- Corrections
- If you find an error, write to contact@effycace.com. Corrections are recorded in the version history below.
How to cite
Fahad Imran (2026). Severity is not a schedule: how well CVSS and EPSS predicted real exploitation (Report EFF-RR-2026-002, version 1.0). Effycace Solutions Pte Ltd. https://www.effycace.com/research/reports/cvss-epss-exploitation-2024-2026/
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 11 November 2026 | First published. |
This report is general information, not advice for your specific circumstances. See our Terms of Use.