CISA KEV vs EPSS: lagging and leading signals

CISA's Known Exploited Vulnerabilities (KEV) catalog lists CVEs that have evidence of real exploitation, a CVE ID and clear remediation guidance. US federal civilian agencies must fix them by a due date under a binding operational directive, and many other organisations use the list as a “patch this first” queue. It is a lagging indicator: a CVE is added only after attacks have been seen and confirmed. For PHP2Shell, the first exploit attempt was seen on 17 October 2026 and the KEV listing came on 26 October.

FIRST's Exploit Prediction Scoring System (EPSS) is a machine-learning model that estimates the probability that a CVE will see exploitation activity in the next 30 days, as a score from 0 to 1, re-calculated daily. That makes it a leading indicator: a forecast rather than a confirmation. It is still only a model: scores for brand-new CVEs can move quickly, and a low score is not a promise.

Use the two together, and add your own context. KEV says it is happening, EPSS says it is likely, and your asset inventory says whether it matters here. A KEV entry on an internet-facing system you own beats any score; a high EPSS score on something you do not run can wait.