The EPSS score and five old flaws in a fresh joint advisory

The EPSS score meets five old flaws the world is still exploiting#

On 8 October 2026 an advisory arrived with a product ID, AA26-281A, and a contradiction worth sitting with. Ten agencies across seven countries published it together, from the FBI, CISA and NSA to the UK's NCSC, Australia's ACSC, Canada's Cyber Centre, Japan's NPA and NCO, New Zealand's NCSC and Spain's CNI, as the CISA-hosted co-authored copy records. What they described is not a clever new exploit. It is a handful of old, internet-facing programmes, still reachable and still answering. The patient prowl of any half-decent defender would find them, and every one of the five carries an EPSS score. Three of those scores sit above 0.96.

The five flaws on that list are old enough to have children. CVE-2015-3306 is ProFTPD's mod_copy bug, a file-transfer daemon's own improper access control weakness. CVE-2015-5477 is ISC BIND TKEY denial-of-service bug, a decade old. Apache Struts contributed CVE-2016-3081, an injection flaw in dynamic method invocation, ONLYOFFICE Docs contributed CVE-2021-3199, a path traversal reachable through image upload, and Strapi contributed CVE-2023-22894. CISA added all five to its Known Exploited Vulnerabilities catalogue on 8 October and recorded a federal remediation due date of 11 October, as the dated KEV feed shows.

Two things need holding apart, and a vendor that muddles them will be caught out. The governments attribute the activity to a China-based company with links to the Chinese government; that is a state claim, and it should be reported as one. Separately, CISA's own catalogue designates the five CVEs as exploited in the wild, as its authoritative KEV page states. That is a finding, not an attribution, and it is the one a board can act on. The reconnaissance detail is concrete enough for a detection rule: the actors scan six ports, 21, 22, 53, 80, 443 and 1080, per the FBI-hosted copy. A quiet quarry, once it is on the list, should be assumed visible to scanners.

Why EPSS vs CVSS is not a beauty contest#

The tempting move is to line the two scores up and crown a winner. That is the wrong reading of both. EPSS vs CVSS is a comparison between a forecast and a severity grade, and they answer different questions. CVSS grades how much intrinsic damage a flaw could do if it were exploited. EPSS forecasts how likely exploitation activity is in the next 30 days. No single number can carry both jobs at once.

There is a further trap in the CVSS chart below, and it is easy to trip over. The five values all come from one assessor, CISA, recorded as secondary v3.1 scores inside the original NVD records, a vulpine vigilance rather than an industry average. That is the whole point of drawing them together: one assessor, one metric version, one 0 to 10 scale, so the comparison is fair rather than stitched. Read them as one desk's opinion, not as a verdict on your own thicket.

Read the Strapi row closely and the disagreement becomes the story. In this chart Strapi scores 7.2, a CISA secondary figure. NIST's own primary assessment for the same CVE is 4.9, a Medium, on a different reading of the impact. The original vendor advisory goes further still, scoring it 9.8 and calling it Critical, as the Strapi GHSA advisory states. Three numbers, one CVE, all defensible, and none of them a measurement of your exposure. The lesson is not that any score is soft; it is that the assessor matters as much as the digits.

Known exploitation outweighs a low predicted probability#

Here is why the calm answer is the wrong one, and why a single EPSS score, read alone, is the most costly certainty. Strapi's EPSS score, 0.03609 in the dated snapshot, is the lowest of the five by an order of magnitude. A dashboard that sorts on that number alone would file CVE-2023-22894 near the bottom of the queue. Yet CISA listed it as exploited in the wild on the same day as the rest. Known exploitation is observed; EPSS is predicted. When the two disagree, the observation wins.

Weigh the EPSS percentile beside the score and the picture sharpens. Strapi's percentile is 0.89198, which puts it above roughly 89 per cent of all scored CVEs, even though its raw probability is small, per the FIRST.org dated snapshot. An EPSS score that small still ranks above most of the field. A percentile is a rank, not a risk, and a team that reads it as low risk has read the wrong column twice.

• 10

  authoring agencies

• 7

  countries signed up

• 5

  CVEs added to KEV

• 0.99497

  top EPSS probability

• 6

  ports the actors scan

The wider point is a communications one, and it is where security vendors keep losing the room. A dashboard percentage is not an incident and not a breach; it is a probability attached to a whole population, not to the reader's own estate. Saying that plainly is harder than selling urgency, and it is the difference between a number a buyer trusts and a number a buyer learns to filter out.

Risk-based vulnerability management, minus the theatre#

risk-based vulnerability management is the phrase vendors will reach for this week, and it names the right work. The test is whether the practice survives contact with a fresh deadline. A deliberate, defensible programme does three things: it separates a forecast from a finding, it states its assessor and its metric version, and it keeps a federal obligation distinct from a general one. An EPSS score belongs in that conversation as an input, never as the verdict.

For everyone outside the federal perimeter, the 11 October date is a priority signal rather than a legal deadline. CISA's own KEV feed records the 11 October due date for federal civilian agencies. A private company is not bound by it, and pretending otherwise is the kind of overreach a sceptical buyer will punish. What the date does buy a vendor is urgency it did not have to invent, which is exactly why the framing has to stay honest.

Vulnerability triage: what a private team does on 12 October#

vulnerability triage for everyone outside that perimeter is simpler than the acronyms suggest. An EPSS score narrows the field; it never sets the order on its own. The deadline that matters most is the one your own exposure sets, not the one a catalogue prints. Five products, five questions, and a record of the answers is most of the job.

The fix versions are public and dull, which is the good news. BIND moves to 9.9.7-P2 or 9.10.2-P3, the minimum patched releases named at the time for those branches, so confirm the patched release for your supported branch with ISC, Struts to 2.3.20.3, 2.3.24.3 or 2.3.28.1 per the S2-032 bulletin, and ONLYOFFICE Docs to 5.6.3, which its changelog records as fixing the path traversal. ProFTPD distributions carry the fix at 1.3.8b or later per SUSE, and Strapi needs an upgrade to a currently supported release at or above the fixed version: the vendor fixed range runs through 4.7.1, while NVD records 4.5.5, so do not treat any supported release below the fixed version as closed.

This is assessment-led work, and it is the same discipline a clear content programme turns into something a security vendor can publish credibly. It is the ground our cybersecurity marketing practice covers, and the positioning discipline our brand strategy work applies when a vendor has to say something true and still be heard above the noise.

The vixen does not sprint at every sound in the hedgerow. It reads the ground, trusts the trail it can actually see, and moves once, through brush and bracken, scenting the right den before it commits. This week's trail is short and plain: five old flaws, one fresh catalogue entry each, and a set of patent fixes in the undergrowth. Follow that, and the scores can inform the decision without pretending to make it.

Frequently asked questions#