Low EPSS, active exploitation: what OT teams need to act on

TL;DR: Live exploit attempts in September targeted three vulnerabilities across consumer networking, AI tooling and enterprise testing platforms, according to TXOne Networks, each with low EPSS scores but active exploitation signals. The lesson is that EPSS supports prioritisation, but telemetry and exposure state determine real risk.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “Low EPSS, High Risk: Real-World Exploits Caught by IoT/ICS Threat Intelligence Platform in September”.

By the numbers:

• CVE-2025-34035 had an EPSS score of 14.54% (~0.1454) despite being critically exploitable.
• CVE-2025-0868 had an EPSS score of 16% (~0.1605) despite live exploit attempts.

Key questions

Q: What breaks when teams rely on EPSS instead of live exploit telemetry?

A: Patch queues become detached from real attacker activity.

Q: Why do unauthenticated or remotely exploitable vulnerabilities create such a high operational risk for defenders?

A: Unauthenticated or remotely exploitable flaws matter because attackers do not need prior access, stolen credentials, or user interaction to begin exploitation.

Q: What are the signs that a critical vulnerability is moving from theoretical risk to active exploitation?

A: The clearest signs are rapid attacker activity against exposed services, public references to exploitation in threat reporting, and unusual requests against vulnerable interfaces or management ports.

Practitioner guidance

• Prioritise exposed unauthenticated services first Move internet-facing and externally reachable assets to the top of the remediation queue when exploit evidence or public PoCs exist, even if the score is low.
• Combine EPSS with exploit telemetry Require live threat intelligence, callback evidence and asset criticality before assigning remediation SLAs, rather than using EPSS as a gatekeeper.
• Harden parser and execution paths Disable risky features such as eval() and DTD processing where they are not required, and validate inputs before they reach command or parsing logic.

Bottom line: Low EPSS scores do not reliably indicate low exploitation risk when live attack activity is already visible.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →