Definition. EPSS (Exploit Prediction Scoring System) estimates, for every published CVE, how likely it is to be exploited in the wild within the next 30 days. The score is a probability between 0 and 1 and is recalculated daily. It is published by the EPSS Special Interest Group at the Forum of Incident Response and Security Teams (FIRST).
Why it matters. CVSS describes how severe a flaw is. EPSS estimates how likely it is to be attacked. Together with the CISA KEV catalog, which lists attacks already observed, this gives a patching order that does not rely on severity alone. A low score is still an estimate, not an all-clear.
Example. For the Traefik flaw CVE-2026-114640, the EPSS score on 26 October 2026 was 0.2 percent, with a CVSS score of 8.7.