Entropy‐Resolved Exploitation Pressure in Software Vulnerability Ecosystems: Evidence From EPSS, CISA KEV and Exploit‐DB

Vulnerability management is often treated as a critical vulnerability (CVE)‐ranking problem, although rankings alone do not quantify how exploitation risk is distributed across the vulnerability ecosystem. This paper develops an entropy‐resolved exploitation–pressure framework that converts CVE‐level evidence into a probability measure over vulnerabilities and their groupings. Exploit prediction scoring system (EPSS) is used as the base exploitation‐probability layer, CISA known exploited vulnerabilities (KEV) as confirmed exploitation‐in‐the‐wild evidence and Exploit‐DB as a public exploit‐availability structure. KEV information is withheld from candidate score construction and used only for external validation of the pre‐KEV base layer. Real‐data validation on 333,848 EPSS‐scored CVEs, 1592 KEV‐matched CVEs and 24,855 Exploit‐DB‐matched CVEs selects EPSS‐only as the base score, with ROC–AUC 0.9316 and 71.30% top‐5% KEV capture. The induced exploitation–pressure measure is sharply concentrated: the top 5% of ranked CVEs capture 75.52% of operational pressure and 79.96% of KEV evidence. Null‐label robustness confirms that this upper‐tail enrichment exceeds randomised‐label expectation. Interpreted as a review‐capacity frontier, the 5% subset leaves 24.48% of operational pressure outside the initial review queue and provides 15.10‐fold pressure‐coverage efficiency, supporting capacity‐aware first‐stage screening rather than automatic remediation.