Automating Patch Prioritization from the CISA Known Exploited Vulnerabilities Catalog

CVSS was designed to measure the theoretical worst-case impact of a vulnerability, not the likelihood of exploitation. The result is that most CVSS-sorted vulnerability queues are dominated by vulnerabilities that have never seen exploitation in the wild, and vulnerabilities that are being actively exploited sit buried at position 47 in the queue because their CVSS score is only 7.2.

The research evidence is clear: studies combining EPSS (Exploit Prediction Scoring System) and KEV data show that a vulnerability in the KEV catalog is approximately 4 times more likely to be exploited in a real attack than a CVSS Critical vulnerability not in KEV. An organization that patches all KEV-listed vulnerabilities in its environment within 14 days closes more real-world risk than one that patches all CVSS 9.0+ vulnerabilities in the same timeframe.

The barrier to using KEV as a primary signal has been manual: security teams have had to manually compare their scanner output against the catalog. The KEV API removes that barrier entirely.

CISA publishes the KEV catalog as a JSON endpoint that is freely accessible without authentication:

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

The JSON structure includes for each entry:

• cveID: The CVE identifier
• vendorProject: The affected vendor
• product: The specific product
• vulnerabilityName: Human-readable description
• dateAdded: When CISA added it to the catalog
• shortDescription: Brief description
• requiredAction: CISA's recommended mitigation
• dueDate: Required remediation date for federal agencies
• knownRansomwareCampaignUse: Whether it has been used in ransomware

A simple Python script to pull and parse the catalog:

import requests
import json

def get_kev_catalog():
    url = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
    response = requests.get(url, timeout=30)
    response.raise_for_status()
    data = response.json()
    # Build a dict for O(1) lookup by CVE ID
    return {v['cveID']: v for v in data['vulnerabilities']}

kev = get_kev_catalog()
print(f'Loaded {len(kev)} KEV entries')
print(f'Most recent addition: {max(v["dateAdded"] for v in kev.values())}')

Schedule this to run daily. Cache the output locally and diff against the previous run to identify newly added entries.

Each major scanner has an API for retrieving findings that can be cross-referenced against the KEV catalog.

Tenable.io:

import tenable
from tenable.io import TenableIO

tio = TenableIO(access_key='YOUR_ACCESS_KEY', secret_key='YOUR_SECRET_KEY')

# Get all plugin findings
kev_findings = []
for vuln in tio.exports.vulns(
    filters=[('severity', 'gte', '4')]
):
    cve_ids = vuln.get('cve', [])
    for cve in cve_ids:
        if cve in kev:
            kev_findings.append({
                'asset': vuln['asset']['hostname'],
                'cve': cve,
                'kev_entry': kev[cve],
                'scanner_severity': vuln['severity'],
                'plugin_name': vuln['plugin']['name']
            })

print(f'Found {len(kev_findings)} KEV vulnerabilities in environment')

Qualys VMDR: Use the Detection API with a CVE filter. Qualys supports direct KEV integration as of 2024 via the Threat Intelligence module, check your Qualys console for the KEV tag that auto-tags findings matching the catalog.

Rapid7 InsightVM: Use the Vulnerabilities API to retrieve findings and filter by CVE. Rapid7 also provides native KEV integration in their Threat Command module.

Once you have the cross-referenced finding list, automate the escalation. The goal is zero manual steps between CISA adding a CVE to the KEV catalog and your security team having an actionable alert.

Daily differential check, new KEV entries in your environment:

import json
from datetime import date, timedelta

# Load yesterday's KEV catalog
with open('kev_yesterday.json') as f:
    kev_yesterday = json.load(f)

# Today's catalog (fetched above)
kev_today = get_kev_catalog()

# New entries added in the last 24 hours
new_entries = {
    cve: entry for cve, entry in kev_today.items()
    if cve not in kev_yesterday
}

# Cross-reference new entries against your environment
new_critical_findings = [
    finding for finding in get_scanner_findings()  # your scanner API call
    if finding['cve'] in new_entries
]

if new_critical_findings:
    send_p1_alert(new_critical_findings)  # Slack, PagerDuty, Jira ticket creation

Jira ticket creation for KEV findings: Create a Jira ticket with P1 priority automatically for each KEV vulnerability found in your environment. Include the CISA required action, the dueDate, and whether the vulnerability has known ransomware campaign use. This creates an audit trail and ensures the finding is tracked to remediation.

Both Tenable and Qualys offer native KEV integration that does not require custom scripting.

Tenable.io native KEV: In Tenable.io, create a Dashboard widget filtered to CISA KEV. Under Vulnerability Management > Explore > Vulnerabilities, filter by 'CISA KEV' in the Tag section. Tenable automatically updates this filter as CISA adds new entries.

For automated ticket creation in Tenable: configure a Jira integration under Settings > Integrations > Jira, then create a Notification rule that triggers on any finding matching 'CISA KEV = true' with severity >= Medium.

Qualys VMDR native KEV: Qualys introduced KEV-based prioritization as a TruRisk scoring factor. In the VMDR dashboard, the TruRisk score now incorporates KEV status, EPSS, and active exploitation signals into a composite risk score. Filter your findings by TruRisk score rather than CVSS to get KEV-weighted prioritization automatically.

Rapid7 InsightVM: Create a Dynamic Asset Group for assets with any KEV-listed vulnerability: use the query vulnerability.cveIds CONTAINS cisa_kev_ids (available in the InsightVM query builder). This group automatically updates as new KEV entries are added and as new assets are scanned.

CISA requires federal agencies to remediate KEV vulnerabilities within 14 days for internet-facing systems and less for critical infrastructure. For non-federal organizations, use this as a baseline and adjust based on your risk tolerance:

Recommended SLAs:

• KEV + internet-exposed asset: 7 days
• KEV + ransomware use + any exposure: 3 days
• KEV + internal-only asset: 14 days
• KEV + no fix available: document compensating controls within 7 days

Track SLA compliance by calculating: (date_remediated - date_kev_added) for each finding. Report this metric monthly to show the program's effectiveness. An organization that patches all KEV findings in its environment within SLA is operating a more defensible posture than one with a perfect CVSS-sorted queue.