Prediction Meets Patch Queues: Empirical Limits of EPSS-Only Prioritization Using CISA KEV Additions in 2025

The Exploit Prediction Scoring System (EPSS) is often operationalized as a "patch gate": remediate vulnerabilities whose predicted exploitation probability exceeds a chosen threshold. The CISA Known Exploited Vulnerabilities (KEV) catalog represents a stricter notion of ground truth: exploitation has been observed and confirmed. Using all KEV entries added in 2025, endof-year EPSS scores for the 2025 CVE population, and weekly EPSS snapshots throughout 2025, we quantify: (i) the coverage gap where EPSS scores are unavailable at the KEV decision time; (ii) the recall of exploited vulnerabilities under common EPSS thresholds; (iii) score drift and "catch-up" latency as EPSS evolves over time; and (iv) the operational consequences of EPSSonly intake under finite patch capacity. We further decompose the delay at the KEV inclusion moment into signal lag (EPSS not yet actionable) and ops lag (actionable but queued), showing that increasing patch capacity cannot compensate for a missing or late signal. Code, datasets: https://github.com/scadastrangelove/kev_vs_epss.