Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence. Use when working with performing cve prioritization with kev catalog.
Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence. Use when working with performing cve prioritization with kev catalog.
The CISA Known Exploited Vulnerabilities (KEV) catalog, established through Binding Operational Directive (BOD) 22-01, is a living list of CVEs that have been actively exploited in the wild and carry significant risk. As of early 2026, the catalog contains over 1,484 entries, growing 20% in 2025 alone with 245 new additions. This skill covers integrating the KEV catalog into vulnerability prioritization workflows alongside EPSS (Exploit Prediction Scoring System) and CVSS to create a risk-based approach that prioritizes vulnerabilities with confirmed exploitation activity over theoretical severity alone.
Anti-Rationalization Table
Rationalization
Reality
"I'll figure it out as I go"
A structured approach saves time and reduces errors. Follow the workflow in this skill rather than improvising.
"I already know this topic"
Familiarity breeds shortcuts. Use the checklist to verify you haven't missed critical steps.
"This doesn't apply to my situation"
The patterns here generalize across contexts. Adapt, don't skip — the underlying principles hold.
"One more tool will fix it"
Adding complexity rarely solves process gaps. Master the core workflow first.
When to Use
Trigger phrases:
"performing cve prioritization with kev catalog"
"Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVS"
When conducting security assessments that involve performing cve prioritization with kev catalog
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Access to vulnerability scan results (Qualys, Nessus, Rapid7, etc.)
Familiarity with CVE identifiers and NVD
Understanding of CVSS scoring (v3.1 and v4.0)
API access to CISA KEV, EPSS, and NVD endpoints
Python 3.8+ with requests and pandas libraries
Core Concepts
This section covers core concepts for performing cve prioritization with kev catalog.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
CISA KEV Catalog Structure
Each KEV entry contains:
CVE ID: The CVE identifier (e.g., CVE-2024-3094)
Vendor/Project: Affected vendor and product name
Vulnerability Name: Short description of the vulnerability
Date Added: When CISA added it to the catalog
Short Description: Brief technical description
Required Action: Recommended remediation action
Due Date: Deadline for federal agencies (FCEB) to remediate
Known Ransomware Campaign Use: Whether ransomware groups exploit it
BOD 22-01 Remediation Timelines
CVE Publication Date
Remediation Deadline
2021 or later
2 weeks from KEV listing
Before 2021
6 months from KEV listing
Multi-Factor Prioritization Model
Factor
Weight
Data Source
Rationale
CISA KEV Listed
30%
CISA KEV JSON feed
Confirmed active exploitation
EPSS Score
25%
FIRST EPSS API
Predicted exploitation probability
CVSS Base Score
20%
NVD API v2.0
Intrinsic vulnerability severity
Asset Criticality
15%
CMDB/Asset inventory
Business impact context
Network Exposure
10%
Network architecture
Attack surface accessibility
KEV + EPSS Decision Matrix
KEV Listed
EPSS > 0.5
CVSS >= 9.0
Priority
SLA
Yes
Any
Any
P1-Emergency
48 hours
No
Yes
Yes
P1-Emergency
48 hours
No
Yes
No
P2-Critical
7 days
No
No
Yes
P2-Critical
7 days
No
No
No (>= 7.0)
P3-High
14 days
No
No
No (>= 4.0)
P4-Medium
30 days
No
No
No (< 4.0)
P5-Low
90 days
Workflow
Scope and authorize — confirm written authorization and define target boundaries
Reconnaissance — enumerate targets, services, and potential attack surfaces
Exploitation — attempt exploitation of identified vulnerabilities within scope
Post-exploitation — document access level, lateral movement, and data exposure
Report and remediate — compile findings with reproduction steps and fix recommendations
