KEV vs EPSS: what each tells you and how to use them together
Quick answer, Oct 28, 2026As of 28 October 2026, CISA's KEV catalog records vulnerabilities with evidence of exploitation, and sets a federal due date. FIRST's EPSS is a model's estimate of how likely exploitation is. Treat a KEV listing as a fact to act on, and EPSS as a ranking for everything not yet listed. Read both for the same CVE.
What each is
KEV is CISA's Known Exploited Vulnerabilities catalog: an official list of vulnerabilities with evidence of active exploitation. Each entry carries a date added, a required action and, for federal civilian agencies, a due date. It also records whether ransomware use is known.
EPSS, from FIRST, is a model's estimate of the probability that a vulnerability will be exploited. It is an estimate, not an official finding, and it changes as new data arrives.
How to read them together
| If the CVE is... | Read it as | Next check |
|---|---|---|
| In KEV | Exploitation is documented. Act on the required action. | Is the product in your estate, and is it at a fixed version? |
| Not in KEV, high EPSS | Exploitation is likely but not documented. Rank it high. | Is it internet-facing? Is there a fix? |
| Not in KEV, low EPSS | Lower likelihood. Patch on the normal cycle. | Re-check if CISA adds it. |
The same CVE can be looked up with both in one answer: get_cve on the Distributed Risk MCP server returns the CVE record, CISA's KEV listing and exploitation call, and FIRST's EPSS estimate, each dated.
What neither tells you
Whether you run the product, whether it is reachable, or what an outage costs. A KEV listing is a reason to look at your estate, not a verdict on it.
Questions
Should I patch only KEV entries? No. KEV lists what is known to be exploited, and lags the event. EPSS helps rank what is not listed.
Does a KEV entry mean ransomware? Only where the catalog records known ransomware use.
Sources: CISA KEV, FIRST EPSS.