# CISA KEV CVE Lookup

> CISA KEV CVE Lookup is a paid API for AI agents from vuln-intel.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-21).

Checks whether a specific CVE is in CISA's Known Exploited Vulnerabilities catalog and returns its date added, due date, ransomware use, and required remediation action.

## Facts

- Endpoint: GET https://vuln-intel.x402tookit.com/kev-check?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-21
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-kev-cve-lookup-40be8c07
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jHoHbjkSP4QO3hgBbTBjF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-kev-cve-lookup-40be8c07
```

Example prompt: Is CVE-2021-44228 (Log4Shell) in CISA's Known Exploited Vulnerabilities catalog? If so, tell me the date it was added, the patch due date, whether it's been used in ransomware attacks, and what action CISA requires.

## When to prefer this

Use this endpoint when you need a fast, single-CVE lookup against CISA's authoritative Known Exploited Vulnerabilities catalog — specifically when you need KEV membership status, federal patch deadlines, ransomware association, or required remediation actions. Prefer this over generic NVD or EPSS lookups when CISA compliance posture or exploitation-in-the-wild confirmation is the primary concern. It is ideal for compliance workflows (CISA Binding Operational Directives), incident response triage, or patch prioritization pipelines where KEV listing is a key signal.

## Known failure modes

- CVE not found in KEV catalog — verdict field indicates not listed, not an error
- Invalid CVE ID format returns a validation error
- Degraded mode flag set to true if the catalog data source is temporarily unavailable or stale
- Network timeout if upstream CISA catalog endpoint is unreachable
- Missing required 'cve' query parameter results in a 400-level error

## How this service works

Is a CVE in CISA's Known Exploited Vulnerabilities catalog? Date added, due date, ransomware use and required action.

## Output

Returns a verdict on whether the CVE is in the CISA KEV catalog, along with the date it was added, the federal agency remediation due date, ransomware use classification, required remediation action, affected vendor and product, associated CWEs, a plain-English summary, the data source URL, catalog version, and a degraded-mode flag if data freshness is limited.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE id, e.g. CVE-2021-44228"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "cve": {
       "type": [
        "null",
        "string"
       ]
      },
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "cwes": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "name": {
       "type": [
        "null",
        "string"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "vendor": {
       "type": [
        "null",
        "string"
       ]
      },
      "dueDate": {
       "type": [
        "null",
        "string"
       ]
      },
      "product": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "summary": {
       "type": [
        "null",
        "string"
       ]
      },
      "verdict": {
       "type": [
        "null",
        "string"
       ]
      },
      "degraded": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "dateAdded": {
       "type": [
        "null",
        "string"
       ]
      },
      "sourceUrl": {
       "type": [
        "null",
        "string"
       ]
      },
      "disclaimer": {
       "type": [
        "null",
        "string"
       ]
      },
      "notChecked": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "ransomwareUse": {
       "type": [
        "null",
        "string"
       ]
      },
      "catalogVersion": {
       "ty
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-kev-cve-lookup-40be8c07/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from vuln-intel.x402tookit.com](https://www.zero.xyz/host/vuln-intel.x402tookit.com/llms.txt)