Your security team just got word that CISA added four new entries to the Known Exploited Vulnerabilities Catalog. You've got SonicWall SMA1000 appliances and Microsoft infrastructure in your environment. What should you do next?
If you're still handling KEV responses manually, you're already behind. Here's a script template to automate your KEV Catalog monitoring, asset correlation, and remediation tracking.
Automate Your Vulnerability Management
This script template automates the following tasks:
- Pulls the current KEV Catalog daily via CISA's JSON feed.
- Correlates KEV entries against your asset inventory.
- Generates prioritized remediation tickets.
- Tracks compliance with your internal remediation deadlines.
- Creates audit evidence for risk-based vulnerability management.
While Binding Operational Directive 26-04 mandates specific timelines for Federal Civilian Executive Branch agencies, your organization can benefit from the same risk-based prioritization framework. The KEV Catalog identifies vulnerabilities with confirmed active exploitation. If you're patching based solely on CVSS scores, you're treating theoretical risk the same as actual attacker behavior.
Prerequisites
Before implementing this script, ensure you have:
Technical requirements:
- Access to CISA's KEV Catalog JSON feed.
- Asset inventory system with API access (ServiceNow, Jira, or similar).
- Vulnerability scanner output (Tenable, Qualys, Rapid7, etc.).
- Ticketing system with automation capabilities.
Organizational prerequisites:
- Defined remediation SLAs for publicly exposed assets vs. internal systems.
- Asset classification schema distinguishing "total control" systems (domain controllers, VPN gateways, authentication servers).
- Documented procedure for compromise assessment when patches are delayed.
Data mapping:
- CVE IDs linked to your vulnerability scan results.
- Asset tags identifying public exposure status.
- System criticality ratings in your CMDB.
Script Template
#!/usr/bin/env python3
"""
KEV Catalog Remediation Workflow
Automates CISA KEV monitoring and asset correlation
"""
import requests
import json
from datetime import datetime, timedelta
# Configuration
KEV_FEED_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
ASSET_API_ENDPOINT = "YOUR_ASSET_INVENTORY_API"
TICKET_API_ENDPOINT = "YOUR_TICKETING_SYSTEM_API"
# Remediation deadlines (customize based on your risk tolerance)
CRITICAL_ASSET_DAYS = 7 # Publicly exposed, total control systems
HIGH_RISK_DAYS = 14 # Publicly exposed, non-critical
INTERNAL_DAYS = 30 # Internal systems
def fetch_kev_catalog():
"""Pull current KEV Catalog from CISA"""
response = requests.get(KEV_FEED_URL)
return response.json()
def get_affected_assets(cve_id):
"""Query your asset inventory for systems with this CVE"""
# Replace with your actual asset inventory query
params = {
'vulnerability': cve_id,
'status': 'active'
}
response = requests.get(ASSET_API_ENDPOINT, params=params)
return response.json()
def calculate_deadline(asset):
"""Determine remediation deadline based on asset classification"""
if asset['public_exposure'] and asset['criticality'] == 'total_control':
return datetime.now() + timedelta(days=CRITICAL_ASSET_DAYS)
elif asset['public_exposure']:
return datetime.now() + timedelta(days=HIGH_RISK_DAYS)
else:
return datetime.now() + timedelta(days=INTERNAL_DAYS)
def create_remediation_ticket(cve_data, asset, deadline):
"""Generate prioritized remediation ticket"""
ticket = {
'title': f"KEV Remediation Required: {cve_data['cveID']} on {asset['hostname']}",
'description': f"""
CISA KEV Catalog Entry Detected
CVE: {cve_data['cveID']}
Vulnerability: {cve_data['vulnerabilityName']}
Vendor/Product: {cve_data['vendorProject']} {cve_data['product']}
Date Added to KEV: {cve_data['dateAdded']}
Affected Asset: {asset['hostname']}
Asset Classification: {asset['criticality']}
Public Exposure: {asset['public_exposure']}
Business Owner: {asset['owner']}
Required Action: {cve_data['requiredAction']}
Remediation Deadline: {deadline.strftime('%Y-%m-%d')}
COMPLIANCE NOTE:
This vulnerability has confirmed active exploitation. If remediation
is delayed beyond the deadline, perform compromise assessment per
[YOUR INCIDENT RESPONSE PROCEDURE].
Evidence of active exploitation means this vulnerability is being
used in real attacks. Prioritize accordingly.
""",
'priority': 'P1' if asset['public_exposure'] else 'P2',
'due_date': deadline.isoformat(),
'labels': ['KEV', 'active_exploitation', cve_data['cveID']]
}
response = requests.post(TICKET_API_ENDPOINT, json=ticket)
return response.json()
def main():
"""Main workflow execution"""
kev_data = fetch_kev_catalog()
# Process each vulnerability in the catalog
for vuln in kev_data['vulnerabilities']:
cve_id = vuln['cveID']
# Find affected assets in your environment
affected_assets = get_affected_assets(cve_id)
if not affected_assets:
continue # No exposure in your environment
# Create remediation tickets with appropriate deadlines
for asset in affected_assets:
deadline = calculate_deadline(asset)
ticket = create_remediation_ticket(vuln, asset, deadline)
print(f"Created ticket {ticket['id']} for {cve_id} on {asset['hostname']}")
if __name__ == "__main__":
main()
Customizing the Script
Adjust your deadline windows: The script uses three tiers. You might need four if you separate production from development environments, or two if your organization treats all internet-facing systems identically. Base your deadlines on your actual patch deployment cycle.
Map to your asset taxonomy:
The calculate_deadline() function references public_exposure and criticality fields. Your CMDB might use internet_facing, DMZ_asset, or risk_tier. Update the field names to match your schema.
Integrate compromise assessment triggers: BOD 26-04 requires federal agencies to check for compromise when patches are delayed. Add a conditional in your script: if the deadline passes and the ticket remains open, automatically generate a forensic investigation task. This creates audit evidence that you're following risk-based procedures even when remediation is incomplete.
Add vendor-specific logic: The recent KEV additions included CVE-2026-15409 and CVE-2026-15410 for SonicWall SMA1000 appliances, plus CVE-2026-56155 and CVE-2026-56164 for Microsoft infrastructure. If you've got standardized patch procedures for specific vendors, add conditional logic to assign tickets to the right teams automatically.
Connect to your scanner API:
Replace the get_affected_assets() placeholder with actual API calls to Tenable, Qualys, or your vulnerability management platform. Most commercial scanners let you query by CVE ID and return affected hostnames with current patch status.
Validation Steps
Test the KEV feed connection:
Run curl https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities | length' to confirm you can reach the feed and parse the JSON structure.
Verify asset correlation accuracy: Manually check three CVEs from the catalog against your vulnerability scanner. Do the script's results match what your scanner reports? If you're seeing false negatives, your asset inventory might not be tagging CVEs correctly.
Confirm deadline calculations:
Create test assets with different classification tags and run them through calculate_deadline(). A publicly exposed domain controller should get your shortest deadline. An internal development server should get your longest.
Check ticket creation: Run the script against a single known-vulnerable test system. Does the ticket include all required fields? Can your security team actually use the information to remediate? If your tickets are getting ignored, the description template needs work.
Measure your actual remediation velocity: After running this for 30 days, calculate your median time-to-patch for KEV vulnerabilities vs. non-KEV vulnerabilities. If there's no difference, your team isn't treating active exploitation as a meaningful signal. That's a prioritization problem, not a technical one.
The KEV Catalog gives you intelligence that most vulnerability management programs ignore: proof that attackers are using specific techniques right now. Your script should make that intelligence actionable within hours, not weeks.
