CISA Known Exploited Vulnerabilities API

Free CISA Known Exploited Vulnerabilities catalogue as JSON, no key: every CVE with confirmed in-the-wild exploitation, with required remediation actions and due dates.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the CISA Known Exploited Vulnerabilities API?

The CISA Known Exploited Vulnerabilities catalogue is a free, key-free JSON feed listing every vulnerability CISA has confirmed is being exploited in the wild. Each entry carries the CVE ID, vendor, product, a description, the required remediation action, a compliance due date and whether it is known to be used in ransomware campaigns.

The KEV catalogue is deliberately small and deliberately strict. Where the CVE list holds hundreds of thousands of entries, KEV held 1,673 in the run captured here, because CISA only adds a vulnerability when there is reliable evidence of active exploitation, a clear remediation, and an assigned CVE ID. That selectivity is what makes it useful: if something is on this list, it is not theoretical.

It is also a compliance instrument, not just an intelligence feed. US federal civilian agencies are directed to remediate KEV entries by the `dueDate` in each record, and that has made the catalogue a de facto patching priority list well beyond government. Two fields carry most of the practical weight: `knownRansomwareCampaignUse`, which flags vulnerabilities observed in ransomware operations, and `requiredAction`, which frequently says more than "apply the patch" — sometimes the answer is to discontinue the product. The whole catalogue is one JSON document of a few megabytes, so fetch it periodically and index locally rather than requesting it per lookup.

Quick facts

Base URL: https://www.cisa.gov/sites/default/files/feeds
Authentication: No API key or account. The catalogue is US government work and is in the public domain; CISA publishes it for unrestricted use.
Rate limit: None published. This is one static file regenerated when the catalogue changes — fetch it daily at most and cache it.
Pricing: Free, public domain.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the CISA Known Exploited Vulnerabilities API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch the complete Known Exploited Vulnerabilities catalogue

GET https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

curl

curl 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'

JavaScript (fetch)

const res = await fetch("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "title": "CISA Catalog of Known Exploited Vulnerabilities",
  "catalogVersion": "2026.08.20",
  "dateReleased": "2026-08-20T17:00:27.8837Z",
  "count": 1673,
  "vulnerabilities": [
    {
      "cveID": "CVE-2026-72530",
      "vendorProject": "TrueConf",
      "product": "Server",
      "vulnerabilityName": "TrueConf Server Code Injection Vulnerability",
      "dateAdded": "2026-08-20",
      "shortDescription": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
      "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "dueDate": "2026-09-03",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage

Parameters

Parameter	Type	Required	Description
`(no parameters)`	n/a	Optional	The feed is a single static JSON document. Filter client-side after fetching.
`(alternative) known_exploited_vulnerabilities.csv`	path	Optional	The same catalogue as CSV, if that suits your pipeline better. `known_exploited_vulnerabilities.csv`
`(alternative) known_exploited_vulnerabilities_schema.json`	path	Optional	The JSON Schema for the feed, useful for validation. `known_exploited_vulnerabilities_schema.json`

Response fields

catalogVersionstring: Date-stamped catalogue version. Compare it against your last sync to detect changes cheaply.
countinteger: Number of vulnerabilities in the catalogue — small by design.
vulnerabilities[].cveIDstring: The CVE identifier, your join key to CVE, NVD and EPSS data.
vulnerabilities[].vendorProject / productstring: Vendor and product names as CISA writes them, which do not always match CPE strings.
vulnerabilities[].dateAddedstring: When CISA added the entry, which starts the remediation clock.
vulnerabilities[].dueDatestring: Remediation deadline for US federal civilian agencies. Widely adopted elsewhere as a priority signal.
vulnerabilities[].requiredActionstring: What CISA directs be done. Sometimes patching; sometimes discontinuing use of the product.
vulnerabilities[].knownRansomwareCampaignUsestring: `Known` or `Unknown`. The single highest-signal field in the feed.

What you can build with the CISA Known Exploited Vulnerabilities API

Flag vulnerabilities in your estate that are confirmed exploited
Drive patching priority from evidence rather than CVSS score
Track compliance against CISA remediation due dates
Filter a vulnerability scan report down to ransomware-associated CVEs
Combine with EPSS to separate confirmed from predicted exploitation

Common errors and how to fix them

Large response

The whole catalogue arrives in one document.

Fix: That is the design. Fetch once per day, store locally, and look up by CVE against your own index.

Product names do not match your inventory

CISA uses human-readable vendor and product names, not CPE.

Fix: Join on `cveID` instead, then resolve products through NVD's CPE data if you need machine matching.

Entry missing for a CVE you know is exploited

KEV requires CISA-verified evidence and a clear remediation.

Fix: The catalogue is deliberately conservative. Use EPSS or a commercial threat feed for a broader, less certain picture.

Stale local copy

You are not checking the catalogue version.

Fix: Compare `catalogVersion` before reprocessing. It changes only when CISA updates the list.

CISA Known Exploited Vulnerabilities API — frequently asked questions

Is the CISA KEV catalogue free to use?

Yes. It is US government work in the public domain, published as a plain JSON or CSV file with no key, no registration and no usage restrictions.

What does it mean for a CVE to be in the KEV catalogue?

CISA has reliable evidence that the vulnerability is being actively exploited in the wild, it has an assigned CVE ID, and there is a clear remediation available. All three conditions must hold, which is why the list is small relative to the CVE corpus.

How does KEV differ from EPSS?

KEV records confirmed exploitation; EPSS predicts the probability of future exploitation. KEV is evidence, EPSS is a forecast. Something on KEV needs attention now; a high EPSS score suggests something may be about to.

Do the due dates apply to my organisation?

Formally they bind US federal civilian executive branch agencies under a CISA directive. Everyone else has adopted them informally as a sensible remediation deadline, which is a reasonable way to use them but carries no legal force outside that scope.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

CSV Filter

Filter CSV rows online by column conditions — equals, contains, regex, empty, numeric ranges — combined with AND/OR. Keep or remove matches, fully in-browser.

CISA Known Exploited Vulnerabilities is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.