# CISA Known Exploited Vulnerabilities (KEV) Lookup

> CISA Known Exploited Vulnerabilities (KEV) Lookup is a paid API for AI agents from bess-x402.onrender.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-30).

Check CVEs against CISA's Known Exploited Vulnerabilities catalog or search by vendor/product, with date added, remediation due date, ransomware use, and required action.

## Facts

- Endpoint: GET https://bess-x402.onrender.com/v1/security/kev?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-kev-lookup-9ee992c9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__Qb4e6xQH12u3FOIhB6Z3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cisa-known-exploited-vulnerabilities-kev-lookup-9ee992c9
```

Example prompt: Is CVE-2021-44228 (Log4Shell) in CISA's Known Exploited Vulnerabilities catalog? If so, tell me the date it was added, the remediation due date, and whether it's associated with ransomware.

## When to prefer this

Use this endpoint when you need to check whether specific CVEs are actively exploited in the wild according to CISA, or when you need to prioritize patching decisions based on official U.S. government threat intelligence. Prefer this over generic CVE databases (NVD, Mitre) when the key question is 'is this being exploited right now and do I have a federal remediation deadline?' It is especially valuable for ransomware-aware patch triage and compliance with CISA's Binding Operational Directive 22-01.

## Known failure modes

- CVE not found in KEV catalog — returns empty results (not all CVEs are in KEV, only actively exploited ones)
- Invalid CVE format causes no match — ensure format is CVE-YYYY-NNNNN
- No results for vendor/product query if search terms don't match CISA's naming conventions
- Rate limiting or service unavailability from the underlying render.com hosted service
- Stale data if CISA catalog has not been recently synced

## How this service works

Check CVEs against CISA's Known Exploited Vulnerabilities catalog or search it by vendor/product: date added, remediation due date, ransomware use, CWE and required action. Use to prioritise patching.

## Output

Returns matching entries from the CISA KEV catalog, each including the CVE ID, vendor, product name, vulnerability name, date added to the catalog, remediation due date, whether the CVE has known ransomware use, CWE classification, and CISA's required action. Results are filtered by the provided query parameters (CVE ID, vendor/product keywords, recency window, ransomware flag, and result limit).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {
      "q": {
       "type": "string",
       "description": "Vendor or product words, e.g. fortinet"
      },
      "cve": {
       "type": "string",
       "description": "CVE id, e.g. CVE-2021-44228"
      },
      "days": {
       "type": "integer",
       "description": "Only entries added in the last N days"
      },
      "limit": {
       "type": "integer",
       "description": "Maximum number of results (1-100)"
      },
      "ransomware": {
       "type": "boolean",
       "description": "Only known ransomware use"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cisa-known-exploited-vulnerabilities-kev-lookup-9ee992c9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bess-x402.onrender.com](https://www.zero.xyz/host/bess-x402.onrender.com/llms.txt)