Low EPSS scores can still mask active exploit campaigns

At a glance

What this is: TXOne Networks shows that September exploit attempts against three CVEs were actively observed in the wild despite low EPSS scores, including unauthenticated command injection, remote code execution and XXE.

Why it matters: This matters because exposure-driven exploitation can outrun score-based patch triage, so IAM, OT and security teams need telemetry-led prioritisation rather than relying on EPSS alone.

By the numbers:

• CVE-2025-34035 had an EPSS score of 14.54% (~0.1454) despite being critically exploitable.
• CVE-2025-0868 had an EPSS score of 16% (~0.1605) despite live exploit attempts.

Context

EPSS is a probability signal, not a substitute for exposure analysis or exploit telemetry. A low score can still coexist with active exploitation when attackers can automate scanning, reach the target directly and trigger a flaw without credentials.

For operational security teams, the governance gap is not the lack of a score, but the habit of treating score as a decision gate instead of one input. That gap becomes more visible in OT and industrial environments, where internet-facing assets and legacy services can stay exposed longer than intended.

Key questions

Q: What breaks when teams rely on EPSS instead of live exploit telemetry?

A: Patch queues become detached from real attacker activity. A low EPSS score can still hide active exploitation, public proof-of-concept code and exposed services that attackers can automate immediately. Teams then spend scarce remediation effort on predicted risk while the most reachable systems remain open to unauthenticated abuse.

Q: Why do unauthenticated or remotely exploitable vulnerabilities create such a high operational risk for defenders?

A: Unauthenticated or remotely exploitable flaws matter because attackers do not need prior access, stolen credentials, or user interaction to begin exploitation. That lowers the barrier to entry and expands the pool of possible attackers. Once a foothold exists, attackers can pivot into code execution, data access, privilege escalation, or persistence, making containment harder and slower.

Q: What are the signs that a critical vulnerability is moving from theoretical risk to active exploitation?

A: The clearest signs are rapid attacker activity against exposed services, public references to exploitation in threat reporting, and unusual requests against vulnerable interfaces or management ports. If a product has many exposed endpoints and the flaw enables unauthenticated or low-friction access, the risk should be treated as immediate. Security teams should assume hostile scanning and exploitation will follow quickly.

Q: Should industrial teams prioritise exposure state or severity score first?

A: Exposure state should come first when the service is reachable and exploitation is already being observed. Severity still matters, but it should not outrank live attack evidence, especially in OT environments where patching is slower and the operational cost of delayed containment can be higher than the cost of emergency remediation.

Technical breakdown

Why low EPSS can miss active exploitation

EPSS estimates the likelihood that a vulnerability will be exploited in the near term, but it does not measure whether exploitation is already happening in a specific environment. In practice, attackers can act on public proof-of-concept code, opportunistic scanning and exposed services before a score meaningfully changes. That creates a control gap between predictive prioritisation and live adversary behaviour. For OT and industrial environments, the problem is sharper because asset exposure, patch latency and service availability constraints often delay remediation even when evidence of attack exists. See the Vulnerability Management Guide.

Practical implication: Treat EPSS as one prioritisation input and let live telemetry override it when exploitation is already observable.

How unauthenticated exploits turn exposure into immediate risk

All three cases in the article relied on unauthenticated attack paths, including command injection, zero-click remote code execution and XXE. That matters because no credential theft or account compromise is required to reach code execution or parser abuse. The attacker only needs network reachability and a vulnerable service. Once the payload runs, out-of-band callbacks can confirm execution and help the attacker iterate. This is why exposed management interfaces and internet-facing OT services need tighter inventory, filtering and emergency patch handling than score-only workflows imply. See the Zero-Day and Exploited Vulnerabilities Guide.

Practical implication: Prioritise exposed unauthenticated services first, because they collapse the distance between discovery and compromise.

Why telemetry should outrank static scoring in patch decisions

The article’s core architectural point is that vulnerability management becomes more reliable when static scoring is combined with exploit evidence, asset criticality and environment context. EPSS helps sequence work, but live exploit attempts, public exploit availability and observed callbacks provide stronger signals that a vulnerability has moved from theoretical to operational. That combination is especially important for industrial environments where downtime and safety considerations can distort patch timing. A control programme that cannot incorporate telemetry will systematically underweight the most active threats.

Practical implication: Correlate EPSS with threat telemetry and exposure data before setting remediation SLAs.

Threat narrative

Attacker objective: The attacker wants reliable remote execution or confirmed service interaction on exposed targets so the vulnerability can be operationalised at scale.

1. Entry occurs through unauthenticated exposure of a vulnerable internet-facing service, allowing attackers to reach the application without stolen credentials.
2. Credential access is not required because the payloads trigger command execution, parser abuse or remote code execution directly through the vulnerable interface.
3. Impact follows when the attacker gains shell execution or service-level control, enabling further probing, automation or follow-on exploitation.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Low EPSS is not a control objective: EPSS is a triage aid, not a measure of whether exploitation is already underway. When defenders let a probability score decide patch urgency on its own, they confuse prediction with exposure reality. In OT and industrial settings that mistake is amplified by internet-facing devices, service constraints and slower maintenance windows. The programme implication is to treat EPSS as one signal inside a broader operational risk model, not the model itself.

Exploitability and exposure beat abstract risk scoring: The article shows that unauthenticated command injection, zero-click RCE and XXE can all be exploited before a score ever feels urgent. That is the practical lesson behind actively exploited vulnerabilities: if a service is reachable and a public exploit exists, the operational question is not whether the score is high enough, but whether the asset is already in the blast radius. Teams should weight reachability, exploit maturity and callback evidence above generic severity.

OT governance fails when prioritisation ignores live telemetry: Industrial environments often inherit patch timing friction, but that does not justify score-only decisions. The failure mode is a governance process that waits for a number to rise while attackers already have a working path. This is the same prioritisation blind spot that appears in many exposure-led incidents, and it creates avoidable dwell time for commodity exploits. The practitioner conclusion is clear: telemetry must be a formal input to remediation governance, not a retrospective justification.

Exposure management is the real named concept here: the article is really about the gap between what a score predicts and what exposed assets invite. Low EPSS created a false sense of safety only because the environment still contained reachable, automatable targets. That gap is where exploit campaigns thrive, especially in mixed IT and OT estates. Teams should manage exposure state as an operational control, not as an after-the-fact reporting metric.

Vulnerability governance should treat threat intel as a control signal: when live exploitation is observed, the organisation has already crossed from hypothetical risk into active threat response territory. That means prioritisation must move from backlog management to exposure containment, especially for externally reachable systems. The broader lesson for security leaders is to design patch governance around observable attack activity, not around score thresholds alone.

What this signals

Exposure-driven remediation is the right operating model: organisations should stop treating severity scores as a permission slip to defer work. The better model is to combine exploit intelligence, asset reachability and business criticality so that the most reachable systems move first. That approach reduces the gap between discovery and containment without forcing teams to patch everything at once.

Score-based triage needs a telemetry override: a vulnerability that is being actively probed is already a governance event, not just a technical finding. Security leaders should formalise an override path for live exploitation so that patch prioritisation, compensating controls and exception handling can be updated in the same operational cycle.

Attackers exploit the operational gap, not the spreadsheet: low scores, maintenance delays and false comfort are what make exposure valuable to adversaries. The programmes that cope best are the ones that measure internet reachability, watch for callbacks and shorten the time between detection and containment.

For practitioners

• Prioritise exposed unauthenticated services first Move internet-facing and externally reachable assets to the top of the remediation queue when exploit evidence or public PoCs exist, even if the score is low.
• Combine EPSS with exploit telemetry Require live threat intelligence, callback evidence and asset criticality before assigning remediation SLAs, rather than using EPSS as a gatekeeper.
• Harden parser and execution paths Disable risky features such as eval() and DTD processing where they are not required, and validate inputs before they reach command or parsing logic.
• Review OT exposure and patch exceptions Track which industrial assets remain exposed because of maintenance windows, uptime constraints or exception handling, and reassess those exceptions against current exploit activity. See the Vulnerability Management Guide.

Key takeaways

• Low EPSS scores do not reliably indicate low exploitation risk when live attack activity is already visible.
• The article’s three cases show that unauthenticated access and public exploit code can convert exposed systems into immediate targets.
• Practitioners should treat exploit telemetry, reachability and asset criticality as stronger prioritisation inputs than score alone.

Related NHI Mgmt Group resources: Vulnerability Management Guide · Zero-Day and Exploited Vulnerabilities Guide · Threat Intelligence Platform Buyer's Guide · Application Security Posture Management (ASPM) Guide

Key terms

• Exploit Telemetry: Exploit telemetry is the collection of logs, events and host signals that indicate an attack is being attempted or has succeeded. In practice, it includes request patterns, spawned processes, file writes and other artifacts that show a vulnerability has moved from theory into active abuse.
• EPSS: The Exploit Prediction Scoring System estimates the likelihood that a vulnerability will be exploited in the wild. It is useful for prioritisation because it reflects observed threat patterns, but it still needs local identity context such as privilege scope, secret exposure, and reachability.
• Unauthenticated Remote Code Execution: A flaw that lets an attacker run code on a target system without first proving who they are. In enterprise applications, this is especially dangerous because the code executes inside a trusted workload context, which can expose data, internal services, and downstream privileges.
• Out-of-Band Callback: An out-of-band callback is a network request generated by a payload to an external system controlled by the attacker or defender. Security teams use it to confirm that code executed, that parsing occurred or that a vulnerability is reachable in practice.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and identity practitioners connect access control, lifecycle discipline and operational governance across modern environments.