How to use CISA's Known Exploited Vulnerabilities (KEV) catalog
Short answer
CISA publishes the KEV catalog as a free JSON and CSV file. Download it, match its cveID values against the CVEs your scanner found, and patch those first: every entry is a vulnerability CISA has evidence of being exploited. Then rank everything else by EPSS (the probability of exploitation in the next 30 days) and CVSS.
Copy-paste code
Pull KEV and filter it
# the whole catalog
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
# entries known to be used in ransomware campaigns
jq -r '.vulnerabilities[] | select(.knownRansomwareCampaignUse=="Known") | .cveID' kev.json | head
# added in the last 30 days (GNU date)
jq -r --arg d "$(date -d '30 days ago' +%F)" '.vulnerabilities[] | select(.dateAdded >= $d) | [.dateAdded,.cveID,.vendorProject,.product] | @tsv' kev.json
# which of my CVEs are in KEV? (my-cves.txt = one CVE id per line)
jq -r '.vulnerabilities[].cveID' kev.json | grep -Fxf my-cves.txt
# or ask the Kevscope API for a verdict per CVE (KEV + EPSS + CVSS + SSVC), free tier, no key
curl "https://kevscope-api.cybermaxtools.com/api/priority?cve=CVE-2024-3400,CVE-2023-4966"Good to know
The dueDate field is the deadline for US federal civilian agencies under BOD 22-01; it is a useful target for everyone else too.
KEV only lists what is known to be exploited; a CVE not in KEV is not automatically safe. That is why EPSS is the second step.
Kevscope API: Which CVEs to patch first, in one call
from $5Kevscope's API returns a verdict (act_now, high, medium, low) for up to 20 CVEs per call with the evidence: KEV status, due date and ransomware use, EPSS, CVSS and CISA SSVC. The free tier is 200 calls a day.
Secure checkout · 14-day fix-or-refund if it doesn't work as described (terms)Questions
How often is KEV updated?
CISA adds entries several times a week; the JSON file has a dateReleased field.
Is KEV free to use?
Yes, it is published by CISA for anyone to use.
What is a good EPSS threshold?
Many teams act on EPSS above 0.1 (10%) after KEV; pick a threshold your team can actually keep up with.
Free: the Free API Starter Kit
Copy-paste calls for 4 APIs with free daily tiers (CVE priority, VIN recalls, US duty rates, email checks), then 5 short emails on KEV/EPSS, MCP and free data.