What it does. Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cve-prioritization-with-kev-catalog, or copy the skill folder into ~/.claude/skills/performing-cve-prioritization-with-kev-catalog/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md
SKILL.md (verbatim)
name: performing-cve-prioritization-with-kev-catalog
description: Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog,
enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization
engine and report that ranks CVE remediation by real-world exploitation evidence and
BOD 22-01 deadlines. Use when triaging a vulnerability backlog, deciding patch order
across many CVEs, or building an automated KEV+EPSS prioritization workflow.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- cisa-kev
- cve
- vulnerability-prioritization
- epss
- bod-22-01
- threat-intelligence
- remediation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068
Performing CVE Prioritization with KEV Catalog
Overview
The CISA Known Exploited Vulnerabilities (KEV) catalog, established through Binding Operational Directive (BOD) 22-01, is a living list of CVEs that have been actively exploited in the wild and carry significant risk. As of early 2026, the catalog contains over 1,484 entries, growing 20% in 2025 alone with 245 new additions. This skill covers integrating the KEV catalog into vulnerability prioritization workflows alongside EPSS (Exploit Prediction Scoring System) and CVSS to create a risk-based approach that prioritizes vulnerabilities with confirmed exploitation activity over theoretical severity alone.
When to Use
- When conducting security assessments that involve performing cve prioritization with kev catalog
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Access to vulnerability scan results (Qualys, Nessus, Rapid7, etc.)
- Familiarity with CVE identifiers and NVD
- Understanding of CVSS scoring (v3.1 and v4.0)
- API access to CISA KEV, EPSS, and NVD endpoints
- Python 3.8+ with requests and pandas libraries
Core Concepts
CISA KEV Catalog Structure
Each KEV entry contains:
- CVE ID: The CVE identifier (e.g., CVE-2024-3094)
- Vendor/Project: Affected vendor and product name
- Vulnerability Name: Short description of the vulnerability
- Date Added: When CISA added it to the catalog
- Short Description: Brief technical description
- Required Action: Recommended remediation action
- Due Date: Deadline for federal agencies (FCEB) to remediate
- Known Ransomware Campaign Use: Whether ransomware groups exploit it
| CVE Publication Date |
Remediation Deadline |
| 2021 or later |
2 weeks from KEV listing |
| Before 2021 |
6 months from KEV listing |
Multi-Factor Prioritization Model
| Factor |
Weight |
Data Source |
Rationale |
| CISA KEV Listed |
30% |
CISA KEV JSON feed |
Confirmed active exploitation |
| EPSS Score |
25% |
FIRST EPSS API |
Predicted exploitation probability |
| CVSS Base Score |
20% |
NVD API v2.0 |
Intrinsic vulnerability severity |
| Asset Criticality |
15% |
CMDB/Asset inventory |
Business impact context |
| Network Exposure |
10% |
Network architecture |
Attack surface accessibility |
KEV + EPSS Decision Matrix
| KEV Listed |
EPSS > 0.5 |
CVSS >= 9.0 |
Priority |
SLA |
| Yes |
Any |
Any |
P1-Emergency |
48 hours |
| No |
Yes |
Yes |
P1-Emergency |
48 hours |
| No |
Yes |
No |
P2-Critical |
7 days |
| No |
No |
Yes |
P2-Critical |
7 days |
| No |
No |
No (>= 7.0) |
P3-High |
14 days |
| No |
No |
No (>= 4.0) |
P4-Medium |
30 days |
| No |
No |
No (< 4.0) |
P5-Low |
90 days |
Workflow
Step 1: Fetch and Parse the KEV Catalog
import requests
import json
from datetime import datetime
KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
def fetch_kev_catalog():
"""Download and parse the CISA KEV catalog."""
response = requests.get(KEV_URL, timeout=30)
response.raise_for_status()
data = response.json()
catalog = {}
for vuln in data.get("vulnerabilities", []):
cve_id = vuln["cveID"]
catalog[cve_id] = {
"vendor": vuln.get("vendorProject", ""),
"product": vuln.get("product", ""),
"name": vuln.get("vulnerabilityName", ""),
"date_added": vuln.get("dateAdded", ""),
"description": vuln.get("shortDescription", ""),
"action": vuln.get("requiredAction", ""),
"due_date": vuln.get("dueDate", ""),
"ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
}
print(f"[+] Loaded {len(catalog)} CVEs from CISA KEV catalog")
print(f" Catalog version: {data.get('catalogVersion', 'N/A')}")
print(f" Last updated: {data.get('dateReleased', 'N/A')}")
return catalog
kev = fetch_kev_catalog()
Step 2: Enrich with EPSS Scores
EPSS_API = "https://api.first.org/data/v1/epss"
def get_epss_scores(cve_list):
"""Fetch EPSS scores for a batch of CVEs."""
scores = {}
batch_size = 100
for i in range(0, len(cve_list), batch_size):
batch = cve_list[i:i + batch_size]
cve_param = ",".join(batch)
response = requests.get(EPSS_API, params={"cve": cve_param}, timeout=30)
if response.status_code == 200:
for entry in response.json().get("data", []):
scores[entry["cve"]] = {
"epss": float(entry.get("epss", 0)),
"percentile": float(entry.get("percentile", 0)),
}
return scores
Step 3: Build the Prioritization Engine
import pandas as pd
def prioritize_vulnerabilities(scan_results, kev_catalog, epss_scores):
"""Apply multi-factor prioritization to scan results."""
prioritized = []
for vuln in scan_results:
cve_id = vuln.get("cve_id", "")
cvss_score = float(vuln.get("cvss_score", 0))
asset_criticality = float(vuln.get("asset_criticality", 3))
exposure = float(vuln.get("network_exposure", 3))
in_kev = cve_id in kev_catalog
kev_data = kev_catalog.get(cve_id, {})
epss_data = epss_scores.get(cve_id, {"epss": 0, "percentile": 0})
epss_score = epss_data["epss"]
# Composite risk score calculation
risk_score = (
(1.0 if in_kev else 0.0) * 10 * 0.30 +
epss_score * 10 * 0.25 +
cvss_score * 0.20 +
(asset_criticality / 5.0) * 10 * 0.15 +
(exposure / 5.0) * 10 * 0.10
)
# Assign priority level
if in_kev or (epss_score > 0.5 and cvss_score >= 9.0):
priority = "P1-Emergency"
sla_days = 2
elif epss_score > 0.5 or cvss_score >= 9.0:
priority = "P2-Critical"
sla_days = 7
elif cvss_score >= 7.0:
priority = "P3-High"
sla_days = 14
elif cvss_score >= 4.0:
priority = "P4-Medium"
sla_days = 30
else:
priority = "P5-Low"
sla_days = 90
prioritized.append({
"cve_id": cve_id,
"cvss_score": cvss_score,
"epss_score": round(epss_score, 4),
"epss_percentile": round(epss_data["percentile"], 4),
"in_cisa_kev": in_kev,
"ransomware_use": kev_data.get("ransomware_use", "N/A"),
"kev_due_date": kev_data.get("due_date", "N/A"),
"risk_score": round(risk_score, 2),
"priority": priority,
"sla_days": sla_days,
"asset": vuln.get("asset", ""),
"asset_criticality": asset_criticality,
})
df = pd.DataFrame(prioritized)
df = df.sort_values("risk_score", ascending=False)
return df
Step 4: Generate Prioritization Report
def generate_report(df, output_file="kev_prioritized_report.csv"):
"""Generate summary report from prioritized vulnerabilities."""
print("\n" + "=" * 70)
print("VULNERABILITY PRIORITIZATION REPORT - KEV + EPSS + CVSS")
print("=" * 70)
print(f"\nTotal vulnerabilities analyzed: {len(df)}")
print(f"KEV-listed vulnerabilities: {df['in_cisa_kev'].sum()}")
print(f"Ransomware-associated: {(df['ransomware_use'] == 'Known').sum()}")
print("\nPriority Distribution:")
print(df["priority"].value_counts().to_string())
print("\nTop 15 Highest Risk Vulnerabilities:")
top = df.head(15)[["cve_id", "cvss_score", "epss_score", "in_cisa_kev",
"risk_score", "priority"]]
print(top.to_string(index=False))
df.to_csv(output_file, index=False)
print(f"\n[+] Full report saved to: {output_file}")
Best Practices
- Update the KEV catalog daily since CISA adds new entries multiple times per week
- Always cross-reference KEV with EPSS; a CVE may have high EPSS but not yet be in KEV
- Treat all KEV-listed CVEs as P1-Emergency regardless of CVSS score
- Pay special attention to KEV entries flagged with "Known Ransomware Campaign Use"
- Automate KEV comparison against your vulnerability scan results in CI/CD pipelines
- Track KEV due dates separately for FCEB compliance requirements
- Use KEV as a leading indicator for threat hunting; if a CVE is added, check for prior exploitation in your environment
Common Pitfalls
- Relying solely on CVSS scores without checking KEV or EPSS data
- Not updating the KEV catalog frequently enough (CISA updates multiple times weekly)
- Treating non-KEV CVEs as safe; they may be exploited but not yet cataloged
- Ignoring the "ransomware use" field which indicates highest-urgency threats
- Using KEV only for compliance instead of integrating into overall risk management
- prioritizing-vulnerabilities-with-cvss-scoring
- building-vulnerability-data-pipeline-with-api
- implementing-threat-intelligence-scoring
- implementing-vulnerability-remediation-sla
Other files in this skill
assets/template.md (verbatim)
KEV-Based CVE Prioritization Report Template
Assessment Summary
| Field |
Value |
| Report Date |
[YYYY-MM-DD] |
| KEV Catalog Version |
[Version] |
| Total CVEs Analyzed |
[N] |
| KEV-Listed CVEs Found |
[N] |
| Ransomware-Associated CVEs |
[N] |
Priority Distribution
| Priority |
Count |
% |
SLA |
KEV Count |
| P1 - Emergency |
[N] |
[%] |
48 hours |
[N] |
| P2 - Critical |
[N] |
[%] |
7 days |
[N] |
| P3 - High |
[N] |
[%] |
14 days |
[N] |
| P4 - Medium |
[N] |
[%] |
30 days |
[N] |
| P5 - Low |
[N] |
[%] |
90 days |
[N] |
KEV-Listed Vulnerabilities in Environment
| CVE |
Vendor |
Product |
CVSS |
EPSS |
Ransomware |
Due Date |
Status |
| [CVE-ID] |
[Vendor] |
[Product] |
[N.N] |
[0.NN] |
[Y/N] |
[Date] |
[Open/Remediated] |
Scoring Methodology
- CISA KEV (30%): Confirmed active exploitation in the wild
- EPSS Score (25%): Predicted 30-day exploitation probability
- CVSS Base (20%): Intrinsic vulnerability severity
- Asset Criticality (15%): Business impact tier (1-5)
- Network Exposure (10%): Attack surface accessibility
references/api-reference.md (verbatim)
API Reference: CISA KEV Catalog CVE Prioritization
Libraries Used
| Library |
Purpose |
requests |
Fetch KEV catalog JSON from CISA |
json |
Parse vulnerability entries and match against scan data |
csv |
Read vulnerability scanner CSV exports |
datetime |
Calculate remediation deadlines and SLA compliance |
Installation
pip install requests
Data Sources
CISA KEV JSON Feed
URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Format: JSON
Authentication: None (public)
Update frequency: Updated as new exploited CVEs are added (typically several times per week)
CISA KEV CSV Feed
URL: https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
Format: CSV
GitHub Mirror
URL: https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json
Core Operations
Fetch the KEV Catalog
import requests
from datetime import datetime
KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
def fetch_kev_catalog():
resp = requests.get(KEV_URL, timeout=30)
resp.raise_for_status()
data = resp.json()
return {
"title": data["title"],
"catalog_version": data["catalogVersion"],
"date_released": data["dateReleased"],
"count": data["count"],
"vulnerabilities": data["vulnerabilities"],
}
KEV Entry Schema
| Field |
Type |
Description |
cveID |
string |
CVE identifier (e.g., "CVE-2024-12345") |
vendorProject |
string |
Affected vendor (e.g., "Microsoft") |
product |
string |
Affected product (e.g., "Windows") |
vulnerabilityName |
string |
Human-readable vulnerability description |
dateAdded |
string |
Date added to KEV (YYYY-MM-DD) |
shortDescription |
string |
Brief vulnerability description |
requiredAction |
string |
CISA-recommended remediation action |
dueDate |
string |
Remediation deadline for federal agencies (YYYY-MM-DD) |
knownRansomwareCampaignUse |
string |
"Known" or "Unknown" ransomware association |
notes |
string |
Additional context |
Match Scan Results Against KEV
def match_scan_to_kev(scan_cves, kev_catalog):
"""Cross-reference vulnerability scan CVEs against the KEV catalog."""
kev_lookup = {v["cveID"]: v for v in kev_catalog["vulnerabilities"]}
matched = []
unmatched = []
for cve_id in scan_cves:
if cve_id in kev_lookup:
entry = kev_lookup[cve_id]
matched.append({
"cve": cve_id,
"vendor": entry["vendorProject"],
"product": entry["product"],
"due_date": entry["dueDate"],
"ransomware": entry["knownRansomwareCampaignUse"],
"action": entry["requiredAction"],
"overdue": datetime.strptime(entry["dueDate"], "%Y-%m-%d") < datetime.now(),
})
else:
unmatched.append(cve_id)
return {"kev_matches": matched, "non_kev": unmatched}
Prioritize by Risk
def prioritize_kev_findings(kev_matches):
"""Sort KEV matches by priority: overdue > ransomware > due date."""
def priority_key(entry):
score = 0
if entry["overdue"]:
score += 1000
if entry["ransomware"] == "Known":
score += 500
# Earlier due dates get higher priority
days_until = (datetime.strptime(entry["due_date"], "%Y-%m-%d") - datetime.now()).days
score -= days_until
return -score
return sorted(kev_matches, key=priority_key)
def generate_report(scan_results, kev_catalog):
matches = match_scan_to_kev(scan_results, kev_catalog)
overdue = [m for m in matches["kev_matches"] if m["overdue"]]
ransomware = [m for m in matches["kev_matches"] if m["ransomware"] == "Known"]
return {
"total_vulns_scanned": len(scan_results),
"kev_matches": len(matches["kev_matches"]),
"overdue_count": len(overdue),
"ransomware_associated": len(ransomware),
"critical_actions": prioritize_kev_findings(matches["kev_matches"])[:10],
"non_kev_vulns": len(matches["non_kev"]),
}
Monitor KEV Catalog Updates
def check_for_new_entries(last_known_count):
"""Check if new vulnerabilities have been added to KEV."""
catalog = fetch_kev_catalog()
current_count = catalog["count"]
if current_count > last_known_count:
new_entries = catalog["vulnerabilities"][last_known_count:]
return {
"new_entries": len(new_entries),
"latest": new_entries,
"total": current_count,
}
return {"new_entries": 0, "total": current_count}
{
"catalog_version": "2025.01.15",
"total_kev_entries": 1150,
"scan_matches": 12,
"overdue": 3,
"ransomware_associated": 5,
"critical_actions": [
{
"cve": "CVE-2024-21887",
"vendor": "Ivanti",
"product": "Connect Secure",
"due_date": "2024-01-31",
"ransomware": "Known",
"overdue": true,
"action": "Apply mitigations per vendor instructions or discontinue use."
}
]
}
references/standards.md (verbatim)
Standards and References - CVE Prioritization with KEV Catalog
Official CISA Resources
Scoring Systems
KEV Catalog Statistics (2025)
| Metric |
Value |
| Total CVEs in catalog |
1,484+ |
| Added in 2025 |
245 |
| Year-over-year growth |
20% |
| Ransomware-associated (2025) |
24 |
- BOD 22-01: Federal agencies must remediate KEV CVEs per due dates
- PCI DSS v4.0: Prioritize remediation of actively exploited vulns
- NIST CSF 2.0: Risk-based vulnerability prioritization
- ISO 27001:2022 A.8.8: Technical vulnerability management
references/workflows.md (verbatim)
Workflows - CVE Prioritization with KEV Catalog
Workflow 1: Daily KEV Integration Pipeline
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Fetch KEV JSON │────>│ Compare with │────>│ Identify New │
│ Feed (daily) │ │ Previous Version │ │ KEV Entries │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
┌────────────────────────────────────────────────┘
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Cross-Reference │────>│ Flag Matching │────>│ Escalate to P1 │
│ Scan Results │ │ Vulns in Env │ │ Emergency │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
v
┌──────────────────┐ ┌──────────────────┐
│ Notify Remediation│───>│ Track Against │
│ Teams │ │ KEV Due Date │
└──────────────────┘ └──────────────────┘
Workflow 2: Multi-Factor Scoring Pipeline
For each CVE in scan results:
1. Look up CVSS base score from NVD API
2. Fetch EPSS probability from FIRST API
3. Check presence in CISA KEV catalog
4. Check if ransomware-associated in KEV
5. Look up asset criticality from CMDB
6. Determine network exposure (internet/DMZ/internal)
7. Calculate composite risk score
8. Assign priority level (P1-P5)
9. Set remediation SLA based on priority
10. Generate ticket in ITSM system
Workflow 3: KEV-Triggered Threat Hunt
When new CVE added to KEV:
├── Check if vulnerability exists in environment
│ ├── Yes: Immediate P1 escalation
│ │ ├── Search SIEM for exploitation indicators
│ │ ├── Check EDR for related TTPs
│ │ └── Initiate incident response if exploitation found
│ └── No: Document non-applicability
└── Update threat intelligence feeds with KEV IOCs
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.