Topic starter
25/10/2026 11:11 am
TL;DR: Unauthenticated access and public exploit code made three September vulnerabilities attractive targets, TXOne Networks reports. Exposure state and live telemetry should outweigh score alone when exposed systems can be hit immediately.
Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “Low EPSS, High Risk: Real-World Exploits Caught by IoT/ICS Threat Intelligence Platform in September”.
By the numbers:
- CVE-2025-34035 had an EPSS score of 14.54% (~0.1454) despite being critically exploitable.
- CVE-2025-0868 had an EPSS score of 16% (~0.1605) despite live exploit attempts.
Key questions
A: Unauthenticated or remotely exploitable flaws matter because attackers do not need prior access, stolen credentials, or user interaction to begin exploitation.
A: The clearest signs are rapid attacker activity against exposed services, public references to exploitation in threat reporting, and unusual requests against vulnerable interfaces or management ports.
Q: What breaks when teams rely on EPSS instead of live exploit telemetry?
A: Patch queues become detached from real attacker activity.
Practitioner guidance
- Prioritise exposed unauthenticated services first Move internet-facing and externally reachable assets to the top of the remediation queue when exploit evidence or public PoCs exist, even if the score is low.
- Combine EPSS with exploit telemetry Require live threat intelligence, callback evidence and asset criticality before assigning remediation SLAs, rather than using EPSS as a gatekeeper.
- Harden parser and execution paths Disable risky features such as eval() and DTD processing where they are not required, and validate inputs before they reach command or parsing logic.
Bottom line: Low EPSS scores do not reliably indicate low exploitation risk when live attack activity is already visible.
Glossary terms: EPSS, Exploit Telemetry, Unauthenticated Remote Code Execution, Out-of-Band Callback
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Low EPSS is not a control objective: EPSS is a triage aid, not a measure of whether exploitation is already underway. When defenders let a probability score decide patch urgency on its own, they confuse prediction with exposure reality. In OT and industrial settings that mistake is amplified by internet-facing devices, service constraints and slower maintenance windows. The programme implication is to treat EPSS as one signal inside a broader operational risk model, not the model itself.
A question worth separating out:
Q: Should industrial teams prioritise exposure state or severity score first?
A: Exposure state should come first when the service is reachable and exploitation is already being observed. Severity still matters, but it should not outrank live attack evidence, especially in OT environments where patching is slower and the operational cost of delayed containment can be higher than the cost of emergency remediation.
👉 Read our full editorial: Low EPSS scores can still mask active exploit campaigns
This post was modified 7 days ago by NHI Mgmt Group