DEV Community

Build a weekly CVE triage workflow with CISA KEV, EPSS and CVSS

This article was first published on the Rokkhe blog on Hashnode. It was drafted with AI assistance and reviewed and edited by the Rokkhe team; all commands and sources were checked against CISA, FIRST and NVD documentation. A one-hour operational pass you can run every Monday, using official feeds only. 15 November 2026, Asia/Dhaka. By the Rokkhe research team. Most teams do not fail at “finding CVEs.” They fail at deciding which ones to do this week. Three public signals help, and they do not measure the same thing: CISA’s Known Exploited Vulnerabilities (KEV) catalog records vulnerabilities with reliable evidence of exploitation in the wild, and a clear remediation action. EPSS, from FIRST, estimates the probability that a CVE will be exploited in the next 30 days. CVSS describes severity (how bad a successful exploit can be), not whether anyone is exploiting it. This post is a weekly workflow: fetch, join, ticket. It complements the existing Rokkhe briefing on how to prioritize vulnerabilities with CISA KEV, EPSS and CVSS; it does not replace that briefing, and it does not invent a success rate for the method. Do not use this workflow to discuss or publish embargoed research. If a draft is under vendor embargo, it stays out of the queue. TL;DR If a CVE is in KEV and you run the product, treat it as a priority this week, even when EPSS is low. FIRST says that explicitly. Use EPSS for the large majority of CVEs that are not in KEV. Use CVSS to understand impact once you already know a CVE is relevant, not as the only sort key. The commands below only read public APIs. They do not patch anything by themselves. After you patch a KEV item, hunt for signs it was used before the fix. A patch does not prove the box was clean. Three signals, three different questions CISA maintains the KEV catalog so organisations can prioritize vulnerabilities that have already been used. CISA also publishes BOD 26-04, Prioritizing Security Updates Based on Risk (issued 10 June 2026), which carries the KEV criteria forward and tells federal civilian agencies to prioritize using exposure, KEV status, exploit automation and technical impact. You do not have to be a federal agency for the catalog to be useful. CISA encourages every organisation to watch it. FIRST’s “Using EPSS” guidance is careful about what the score is: a calibrated probability of observed exploitation in the next 30 days, not a severity score and not a complete risk score. A low EPSS on a KEV-listed CVE is not a contradiction. KEV says exploitation has already been seen. EPSS says the current signal looks like CVEs that are rarely exploited in the next month. FIRST’s rule of thumb: when a CVE is on KEV, treat it as a priority regardless of EPSS. Use EPSS for everything KEV does not cover. CVSS remains useful for impact: a network-exploitable, no-user-interaction vulnerability is a different change window than a local issue that needs an existing account. It is a poor only-sort, because a “critical” CVE with no exploitation evidence and no instance in your estate should not beat a “high” KEV item you actually run. A fourth, unglamorous signal sits underneath all three: do we have this product, in this version, on a reachable network? If the answer is no, log it and stop. If the answer is “we do not know,” the first ticket is inventory, not a patch. Pull this week’s KEV additions CISA publishes the catalog as a JSON feed. The following command only downloads a public file: curl -fsSL \
'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json' \
- o /tmp/kev.json

Newest dateAdded values first. Adjust the slice as you like.

jq -r '
.vulnerabilities
| sort_by(.dateAdded)
| reverse
| .[:20]
| .[]
| [.dateAdded, .cveID, .vendorProject, .product, .shortDescription]
| @tsv
' /tmp/kev.json
For a weekly pass, filter to additions since last Monday (use your date): SINCE=2026-11-09 # replace with last week's cutoff, in UTC dates as the feed ...

Powered by Readybot.io