Performing CVE Prioritization with KEV Catalog

Overview

The CISA Known Exploited Vulnerabilities (KEV) catalog, established through Binding Operational Directive (BOD) 22-01, is a living list of CVEs that have been actively exploited in the wild and carry significant risk. As of early 2026, the catalog contains over 1,484 entries, growing 20% in 2025 alone with 245 new additions. This skill covers integrating the KEV catalog into vulnerability prioritization workflows alongside EPSS (Exploit Prediction Scoring System) and CVSS to create a risk-based approach that prioritizes vulnerabilities with confirmed exploitation activity over theoretical severity alone.

When to Use

• When conducting security assessments that involve performing cve prioritization with kev catalog
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Access to vulnerability scan results (Qualys, Nessus, Rapid7, etc.)
• Familiarity with CVE identifiers and NVD
• Understanding of CVSS scoring (v3.1 and v4.0)
• API access to CISA KEV, EPSS, and NVD endpoints
• Python 3.8+ with requests and pandas libraries

Core Concepts

CISA KEV Catalog Structure

Each KEV entry contains:

• CVE ID: The CVE identifier (e.g., CVE-2024-3094)
• Vendor/Project: Affected vendor and product name
• Vulnerability Name: Short description of the vulnerability
• Date Added: When CISA added it to the catalog
• Short Description: Brief technical description
• Required Action: Recommended remediation action
• Due Date: Deadline for federal agencies (FCEB) to remediate
• Known Ransomware Campaign Use: Whether ransomware groups exploit it

BOD 22-01 Remediation Timelines

Multi-Factor Prioritization Model

KEV + EPSS Decision Matrix

Workflow

Step 1: Fetch and Parse the KEV Catalog

import requests
import json
from datetime import datetime

KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"

def fetch_kev_catalog():
    """Download and parse the CISA KEV catalog."""
    response = requests.get(KEV_URL, timeout=30)
    response.raise_for_status()
    data = response.json()

    catalog = {}
    for vuln in data.get("vulnerabilities", []):
        cve_id = vuln["cveID"]
        catalog[cve_id] = {
            "vendor": vuln.get("vendorProject", ""),
            "product": vuln.get("product", ""),
            "name": vuln.get("vulnerabilityName", ""),
            "date_added": vuln.get("dateAdded", ""),
            "description": vuln.get("shortDescription", ""),
            "action": vuln.get("requiredAction", ""),
            "due_date": vuln.get("dueDate", ""),
            "ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
        }

    print(f"[+] Loaded {len(catalog)} CVEs from CISA KEV catalog")
    print(f"    Catalog version: {data.get('catalogVersion', 'N/A')}")
    print(f"    Last updated: {data.get('dateReleased', 'N/A')}")
    return catalog

kev = fetch_kev_catalog()

Step 2: Enrich with EPSS Scores

EPSS_API = "https://api.first.org/data/v1/epss"

def get_epss_scores(cve_list):
    """Fetch EPSS scores for a batch of CVEs."""
    scores = {}
    batch_size = 100

…