Two flaws can share the same catalog, the same date, and the same “patch now” stamp — and be eighty times apart on whether either is actually being hit. CISA’s KEV tells you what’s exploited. It has no way to tell you what’s urgent. EPSS does.

On June 25, CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog on the same day: an input-validation flaw in PTC Windchill and a server-side request forgery bug in Cisco Unified Communications Manager. Read flatly — the way most backlogs read KEV — they carry identical instructions: confirmed exploited, remediate now.

Read against EPSS, they are not in the same universe. The Windchill flaw carries a 30-day exploitation probability of 1.11%. The Cisco SSRF carries 41.69%, and lands in the 98th percentile of every scored CVE in the world. Same catalog, same day, same federal mandate — roughly forty times the near-term pressure. And that’s not even the widest gap in the batch.

The week, by the numbers

This is the last ten entries on our KEV tracker, sorted by EPSS. Every one of them is flagged identically by the catalog. The third column is the one the catalog can’t see.

Three entries under genuine, near-term assault. One in between. Six sitting in the statistical long grass. A flat reading sees ten equal fires; the data sees a distribution. The catalog tells you what to care about. It does not tell you what to do first.

Two catalogs, two questions

The confusion comes from treating KEV and EPSS as if they answer the same thing. They don’t.

KEV is binary and retrospective. A CVE is in the catalog or it isn’t. Inclusion means exploitation was observed at least once, somewhere — that’s the whole bar. It is a membership test, not a ranking, and it says nothing about how much pressure a flaw is under right now.

EPSS is continuous and forward-looking. It publishes a probability that a given CVE will see exploitation activity in the next 30 days, refreshed daily, alongside a percentile that places it against every other scored vulnerability. It says nothing about whether exploitation has already happened — only what’s likely next.

So the two are complementary, not redundant. KEV confirms; EPSS forecasts. The error that wrecks a backlog is using the membership test as the priority list. Being in the room is not the same as being first in line.

The natural experiment hiding in UniFi

If you wanted a controlled test of this, you couldn’t do better than the three UniFi OS flaws CISA added on June 23. We covered them when they landed: all three rated CVSS 10.0, all three confirmed exploited, all added the same day. On every axis a flat backlog can see, they are identical triplets.

EPSS pulls them apart. The input-validation flaw, CVE-2026-34910, sits at 78.56% — top of the catalog. The path-traversal and access-control flaws beside it sit at 2.27% and 2.45%. Same vendor, same severity, same KEV date, and a thirty-fold gap in near-term exploitation likelihood. Given one maintenance window this week, that’s which of the three to spend it on — while the other two stay on the list for their turn.

“CVSS said 10.0. KEV said exploited. Both were true. Neither told you where to start.“

Percentile is not probability

Before you reorganize anything around EPSS, internalize the one place it misleads people. Look back at the Windchill flaw: probability 1.11%, but percentile 61.71. That reads like a contradiction — how is a one-percent chance ranked above three-fifths of all CVEs?

The scale that makes this unavoidable

This would be academic if volume were manageable. It isn’t. 2025 closed with 48,185 published CVEs — about 130 a day, weekends included. Nobody patches that. KEV is the community’s best coarse filter against the flood: roughly 1,629 active entries, a rounding error against the total, and a defensible “care about these” list.

But the filter still hands you sixteen hundred line items stamped “exploited, patch now,” and a flat reading collapses them into one undifferentiated emergency. KEV is also conservative on the front end — VulnCheck counted 883 CVEs newly exploited in 2025 against CISA’s 245 catalog additions. KEV is a floor on what’s confirmed, not a forecast of what’s coming. EPSS is the layer that restores the gradient the catalog flattens.

The model: floor, then order

None of this is an argument to ignore low-EPSS entries. It’s an argument to stop treating the list as flat. Two moves and one adjustment:

We made the structural version of this case in our BOD 26-04 analysis: the flat, one-size deadline was always the wrong shape for a catalog this varied. Applied to this week, the model sorts the ten entries into four bands:

• PATCH NOW · ≥ 70%
  Splunk Enterprise (88.17%), Joomla Content Editor (80.43%), UniFi OS input-validation (78.56%). Top of the catalog, exploitation imminent. Spend this week’s windows here.
• NEXT · 10–70%
  Cisco Unified CM SSRF (41.69%, 98th percentile). Elevated and climbing, not yet at critical mass — but the percentile says don’t let it drift.
• QUEUE · 2–10%
  Cisco SD-WAN Manager (7.68%) and the two remaining UniFi 10.0 flaws (2.45%, 2.27%). High severity, low near-term odds — schedule, don’t scramble.
• FLOORED · < 2%
  LiteSpeed cPanel plugin, Lantronix EDS5000, PTC Windchill. Still mandatory — every one is confirmed exploited. Just not first.

Where the model breaks

The bottom line

Your KEV backlog isn’t lying about what’s exploited. The catalog is honest, and it’s right. It’s lying about what’s urgent — because it has no way to say. Keep the floor: patch all of it. But stop pretending a 1.11% flaw and an 88.17% flaw, stamped on the same line by the same list on the same day, are the same emergency.

Sourcing: all EPSS values and KEV dates are drawn from ByteVanguard’s KEV + EPSS tracker (EPSS snapshot 2026-06-28). EPSS methodology — a 30-day probability of exploitation activity, with percentile as relative rank — follows FIRST’s published definition. The 2025 CVE-volume figure is from Jerry Gamblin’s 2025 CVE Data Review; the 883-vs-245 exploitation gap is VulnCheck data. UniFi CVSS 10.0 ratings per our prior coverage. EPSS is environment-agnostic and does not reflect any single organization’s exposure.

References