RHACS 4.7 has EPSS available as chance of exploitation of a CVE.
But it's impossible to define policy by using this new feature, for example: CVE1 which has CVSS score 9.5 but EPSS 5% should be taken as less important than CVE2 which has CVSS score 8.5 but with EPSS 90%.
Customer will be able to leverage this new feature and prioritize the CVE more reasonable.