What EPSS said before CISA listed a vulnerability

CISA added 92 vulnerabilities to its Known Exploited Vulnerabilities catalog between 2026-09-01 and 2026-11-10. For 22 of them we hold an EPSS score dated before the listing. 21 of those 22 scores were below 10%; the median was 0.57%.

16 of the 22 scores are dated two or more days before the listing, which means we had fetched them at least one day before it; 15 of those 16 were below 10% (median 0.73%). The other 6 are dated the day before the listing and were typically fetched on the listing date (see Method).

On 2026-11-10, 16 of the same 22 scored 10% or higher (median 41.59%). The sample is 22 vulnerabilities this site was already tracking, not the KEV catalog; the limits are listed below and every row is shown.

EPSS score of the same 22 CVEs: first score dated before listing, and on 2026-11-10

First score (dated 1 to 24 days before listing)

Latest score (dated 2026-11-10)

How to read this: each bar counts CVEs out of 22 whose EPSS probability fell in that band. Limits: the scores between the two dates are not recorded, so the chart does not show when a score moved or whether it moved before or after the listing.

The 22 vulnerabilities

How to read this: “Days before” is the gap between the EPSS model date of our first score and CISA’s dateAdded. Limits: “First” is the first score we stored, not the score on the day before listing; a gap of 1 usually means the score was fetched on the listing date.

Checks run against the headline

How to read this: each row recomputes “first score below 10%” on a different cut of the data, with its n. Limits: the last two rows are different populations, shown for comparison, not part of the headline.

Comparison group: of 68 vulnerabilities with a first score dated on or after 2026-09-01 that CISA had not listed by 2026-11-10, 66 had a first score below 10% (median 0.50%), against 21 of 22 (median 0.57%) for those CISA went on to list. The share of first scores below 10% differed by less than 10 percentage points between the two groups. Scores dated 2026-11-10: 16 of 22 listed CVEs are at 10% or higher, against 4 of 68 not listed.

Using a 1% threshold instead of 10%, 16 of 22 first scores dated before listing were below it. The highest was 25.14%. 22 of 22 latest scores are above the first score.

What this can and cannot show

• Selection. A score dated before listing exists only where this site was already tracking the CVE (it had appeared in our coverage and NVD cache) before CISA listed it: 22 of 92 additions. Of the rest, 43 have a first score dated the listing date, 25 a later date, and 2 had no EPSS score on 2026-11-10. Those are excluded from the headline. This is not a sample of the KEV catalog. CVEs enter our tracking because security news covered them, often because exploitation was already being reported, so “before CISA listed it” is not “before exploitation was known”.
• First score, not last. We store the first, latest and peak score per CVE, not a daily series. The first score is dated 1 to 24 days before listing (median 4). For 2 of 22 the recorded peak is also dated before the listing; for the others we cannot say how high the score went before CISA listed them.
• Model date, not fetch date. 6 of 22 first scores are dated one day before the listing. Because the model date is usually the day before our fetch, those were typically fetched on the listing date itself.
• New CVEs. 15 of the 22 with an NVD publication date in our cache have a first score dated within 7 days of NVD publication. A low score on a CVE that is days old is a statement about a CVE with little history.
• Not listed is not “not exploited”. The comparison group is CVEs absent from KEV on 2026-11-10. CISA may list some later, and KEV does not record all exploitation.
• No cause is established. Where the latest score is higher than the first, this page does not show why, or whether the rise came before or after the listing date.
• The model changes. EPSS is FIRST’s estimate of the probability of exploitation activity in the next 30 days. FIRST recomputes it daily and revises the model from time to time, so scores from different dates are not strictly like for like.

Method

The history was seeded by a single run with scores dated 2026-08-31. A scheduled job has added snapshots since 2026-09-04; it does not succeed every day, so some dates have no snapshot. Each snapshot reads the FIRST EPSS score for every CVE in our NVD cache and every CVE in the CISA KEV catalog (1,973 CVEs with a score on 2026-11-10). The first score stored for a CVE is never overwritten. Source file: /data/epss-history.json.

Dates are the EPSS model date returned by FIRST, not the date we fetched the score. The job usually runs before FIRST publishes that day’s scores, so the model date is usually the day before the fetch. A score dated one day before a listing was therefore typically fetched on the listing date (6 of 22 here); a score dated two or more days before was fetched at least one day before it (16 of 22). Listing dates are CISA’s dateAdded.

A CVE is counted here when its first score is dated strictly before its KEV listing date. Percentages are EPSS probabilities multiplied by 100. Medians of an even-sized group are the mean of the two middle values. Nothing on this page is generated by a language model. The page is rebuilt monthly and is not written if fewer than 20 CVEs qualify. Data through 2026-11-10.