Queue Shock at Model Upgrades: A Longitudinal Audit of EPSS v2–v5 Rank Stability and Prioritization Workload

Authors

Keywords:

EPSS, vulnerability prioritization, model versioning, rank stability, remediation queue, CISA KEV, cybersecurity operations

Abstract

Background: EPSS publishes daily probabilities and percentiles to help defenders prioritize vulnerabilities. Major model replacements may disrupt operational queues, but this discontinuity has not been quantified across public EPSS versions.

References

1. Jacobs J, Romanosky S, Edwards B, Adjerid I, Roytman M. Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice . 2021;2(3):1–17. https://doi.org/10.1145/3436242

2. Jacobs J, Romanosky S, Suciu O, Edwards B, Sarabi A. Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights. In: 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) . 2023:194–206. https://doi.org/10.1109/EuroSPW59978.2023.00027

3. Forum of Incident Response and Security Teams. Get the Data: Exploit Prediction Scoring System. https://www.first.org/epss/data. Accessed 1 October 2026.

4. Forum of Incident Response and Security Teams. Exploit Prediction Scoring System. https://www.first.org/epss/. Accessed 1 October 2026.

5. Forum of Incident Response and Security Teams. Using EPSS. https://www.first.org/epss/using-epss. Accessed 1 October 2026.

6. Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog. Accessed 1 October 2026.

7. Ravalico D, Farina M, Trevisan M, Bartoli A. Analysing the Temporal Dynamics of the Exploit Prediction Scoring Systems (EPSS). 2025. https://doi.org/10.2139/ssrn.5147459

8. Mell P, Spring J. Likely Exploited Vulnerabilities. NIST Cybersecurity White Paper 41. 2025. https://doi.org/10.6028/NIST.CSWP.41

9. Forum of Incident Response and Security Teams. EPSS Frequently Asked Questions. https://www.first.org/epss/faq. Accessed 1 October 2026.

Cybersecurity Advances, Volume 3, Issue 1, 2026 cover for 2026: Vulnerability Intelligence in Operational Systems.

Downloads

Published

2026-10-30

Issue

Vol. 3 No. 1 (2026): 2026: Vulnerability Intelligence in Operational Systems

Section

Articles

License

Copyright (c) 2026 The author(s)

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.