How to Cross-Reference Your Asset Inventory Against the CISA KEV Catalog: Manual Method and Free Python Tool

Before matching, understand what the KEV catalog actually contains.

Each KEV entry includes:

• cveID: the CVE identifier (e.g., CVE-2026-0257)
• vendorProject: the vendor name as CISA writes it (e.g., "Palo Alto Networks")
• product: the product name as CISA writes it (e.g., "PAN-OS")
• dueDate: the remediation deadline for FCEB agencies
• shortDescription: a plain-English description of the vulnerability

The challenge: KEV uses informal product names that do not always match how your CMDB, scanner, or software inventory records them. "Palo Alto Networks" in KEV might be "Palo Alto" or "PAN" in your records. "PAN-OS" might be recorded as "PAN-OS firewall" or just "Palo Alto firewall" in your asset database.

Download the current KEV catalog to inspect the vendor and product names for products you know you run:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r '.vulnerabilities[] | [.vendorProject, .product] | @tsv' | sort -u | head -50

This command shows all unique vendor-product combinations in the catalog. Run it before building your matching logic so you know exactly how CISA represents your vendors.

If you have fewer than 100 software products in your inventory, the manual approach is faster to set up than scripting.

Step 1: Export your software inventory to a spreadsheet. Your sources: CMDB export, vulnerability scanner software inventory report, MDM software inventory, or a manual audit. The key columns you need are Vendor and Product (or a combined Software Name column).

Step 2: Download the KEV catalog as CSV. Go to cisa.gov/known-exploited-vulnerabilities-catalog and download the CSV. Open it in your spreadsheet tool.

Step 3: Create a VLOOKUP or filter on vendorProject. In your spreadsheet, create a helper column that checks if each asset's vendor name appears in the KEV catalog's vendorProject column. Because the strings will not match exactly, this step requires manual review per vendor:

1. Get the unique list of vendors in your inventory
2. For each vendor, search the KEV CSV for matching entries (use Ctrl+F or a filter)
3. Where you find a match, list the KEV product names associated with that vendor
4. Check whether any of those product names appear in your inventory for that vendor

Step 4: For confirmed product matches, pull the KEV entries. For each matched product, record the CVE IDs, due dates, and required actions. This is your KEV exposure list.

This process takes 30 to 60 minutes for a 100-product inventory. For larger inventories, use the Python script below.

This script downloads the current KEV catalog, loads your asset inventory from a CSV, and performs fuzzy matching on vendor and product names to find likely matches. It outputs a report of your KEV-exposed assets.

Required format for your inventory CSV: A file named assets.csv with at minimum these columns: vendor, product. Example:

vendor,product,version,hostname
Palo Alto,PAN-OS,10.2.3,fw-01
Microsoft,Defender,4.18.26030.1,all-endpoints
Atlassian,Confluence,7.19.2,wiki-prod

The matching script (save as kev_match.py):

import json
import csv
import urllib.request
from difflib import SequenceMatcher

KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
ASSET_FILE = "assets.csv"
SCORE_THRESHOLD = 0.65  # adjust: higher = fewer false positives

def similarity(a, b):
    return SequenceMatcher(None, a.lower(), b.lower()).ratio()

# Fetch KEV catalog
with urllib.request.urlopen(KEV_URL) as r:
    kev_data = json.loads(r.read())
kev_vulns = kev_data["vulnerabilities"]

# Load asset inventory
with open(ASSET_FILE) as f:
    assets = list(csv.DictReader(f))

print(f"Checking {len(assets)} assets against {len(kev_vulns)} KEV entries...\n")
print(f"{'Asset Vendor':<25} {'Asset Product':<25} {'CVE':<18} {'KEV Vendor':<25} {'KEV Product':<25} {'Due Date':<12}")
print("-" * 130)

matches_found = 0
for asset in assets:
    av = asset.get("vendor", "").strip()
    ap = asset.get("product", "").strip()
    for vuln in kev_vulns:
        kv = vuln["vendorProject"]
        kp = vuln["product"]
        vendor_score = similarity(av, kv)
        product_score = similarity(ap, kp)
        # Both vendor and product must score above threshold
        if vendor_score >= SCORE_THRESHOLD and product_score >= SCORE_THRESHOLD:
            print(f"{av:<25} {ap:<25} {vuln['cveID']:<18} {kv:<25} {kp:<25} {vuln['dueDate']:<12}")
            matches_found += 1

print(f"\nTotal matches: {matches_found}")

Run it:

python3 kev_match.py > kev_exposure_report.txt
cat kev_exposure_report.txt

The SCORE_THRESHOLD parameter controls sensitivity. Start at 0.65. If you see obvious false positives (Microsoft matching against unrelated vendors), increase to 0.75. If you are missing known matches, decrease to 0.55. Review the output manually: fuzzy matching is not perfect, and human confirmation is required for ambiguous matches.

The biggest source of false negatives in automated KEV matching is inconsistent vendor naming. CISA writes "Palo Alto Networks"; your CMDB writes "Palo Alto"; your scanner writes "PAN". The fuzzy matcher handles moderate inconsistency, but explicit normalization produces better results.

Add a normalization dictionary to the script:

VENDOR_MAP = {
    "palo alto": "Palo Alto Networks",
    "pan": "Palo Alto Networks",
    "ms": "Microsoft",
    "msft": "Microsoft",
    "apache foundation": "Apache",
    "apache software foundation": "Apache",
    "jboss": "Red Hat",
    "confluence": "Atlassian",
    "jira": "Atlassian",
    "fortinet": "Fortinet",
    "fortigate": "Fortinet",
    "cisco systems": "Cisco",
    "vmware": "VMware",
    "broadcom vmware": "VMware",
}

def normalize_vendor(v):
    vl = v.lower().strip()
    for key, val in VENDOR_MAP.items():
        if key in vl:
            return val
    return v

Apply this function to both the asset vendor and the KEV vendor before the similarity comparison. Normalization reduces the threshold needed and dramatically cuts false negatives for the most common vendor naming variations.

Once you have your KEV exposure list, prioritize remediation using this framework:

Priority 1 (Patch within 48 hours): Asset is internet-facing or business-critical AND the KEV due date has passed or is within 7 days. This is confirmed exploitation of a product you own, with a past or imminent deadline.

Priority 2 (Patch within 7 days): Asset is internal AND the KEV due date is within 21 days. You have time, but the exploitation is confirmed and active.

Priority 3 (Patch within 30 days): Asset is internal AND the KEV due date is more than 21 days away. Schedule through your normal patch cycle but do not delay further.

For each matched asset, pull the full KEV entry for the required action text. CISA specifies the exact remediation (patch, apply mitigation, or disable feature) in the requiredAction field. This field is more operationally specific than the CVE description and often references vendor-specific guidance.

To get the full required action for all your matched CVEs:

for CVE in CVE-2026-0257 CVE-2025-34291; do
  curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
    | jq -r ".vulnerabilities[] | select(.cveID==\"$CVE\") | [.cveID, .dueDate, .requiredAction] | @tsv"
done

Run this cross-reference at least monthly. The KEV catalog grows continuously, and a product that was clean last month may have a new entry this week. Combine it with the automated KEV alert setup from How to Set Up CISA KEV Alerts Without a SIEM to receive same-day notification when a new KEV entry matches your environment.