# CyberPulse CISA KEV Lookup & Patch Prioritization

> CyberPulse CISA KEV Lookup & Patch Prioritization is a paid API for AI agents from cyberpulse.theaslangroupllc.com, paid per call via x402, $0.08/call, status unknown (last checked 2026-09-14).

Queries the CISA Known Exploited Vulnerabilities catalog by vendor, product, or time range, returning ransomware flags, federal patch due dates, CVSS scores, and prioritized remediation guidance.

## Facts

- Endpoint: GET https://cyberpulse.theaslangroupllc.com/api/cyber/cisa-kev
- Price: $0.08/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-cisa-kev-lookup-patch-prioritization-07407fe3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Cz01mfNW5dGlHchS4RyA2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-cisa-kev-lookup-patch-prioritization-07407fe3
```

Example prompt: Pull all CISA KEV entries for Microsoft products added in the last 90 days — I need to see which ones are ransomware-linked, what the federal patch due dates are, and how CVSS scores break down so I can prioritize our patching queue.

## When to prefer this

Use this endpoint when you need authoritative, CISA-curated exploited vulnerability data with federal compliance deadlines, ransomware linkage flags, and patch prioritization signals — especially for US federal compliance (BOD 22-01) or when triaging which CVEs to patch first based on active exploitation evidence. Prefer over generic NVD lookups when you need ransomware association and government-mandated remediation timelines.

## Known failure modes

- No matching KEV entries found for the specified vendor/product — returns empty result set
- Invalid time range parameters — returns 400 error
- CISA feed temporarily unavailable — returns 503 or stale data warning
- Ambiguous vendor/product name with no exact match — returns partial or no results
- Payment not processed — returns 402 Payment Required

## How this service works

CISA Known Exploited Vulnerabilities (KEV) lookup and patch prioritization. Filter the KEV catalog by vendor, product, or time range; returns ransomware-linked flags, CISA federal due dates, CVSS, and patch priority. Updated daily, for vuln-management and security agents.

## Output

Returns filtered CISA KEV catalog entries matching the query, including CVE IDs, affected vendor and product names, a ransomware-linked boolean flag, CISA-mandated federal patch due dates, CVSS scores, and a patch priority ranking. Results are updated daily from the official CISA KEV feed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "days": {
       "type": "string",
       "description": "Return entries added in last N days — e.g. \"30\" | \"60\" | \"90\" | \"365\" (default: 90)"
      },
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "filter": {
       "type": "string",
       "description": "\"ransomware\" to show only ransomware-linked entries | \"recent\" for last 30 days | omit for vendor search"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor or product name to filter — e.g. \"Cisco\" | \"Ivanti\" | \"Microsoft\" | \"Palo Alto\" | \"Fortinet\" | \"MOVEit\""
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": "Cisco",
  "entries": [
   {
    "cve_id": "CVE-2023-20198",
    "product": "IOS XE",
    "due_date": "2023-11-17",
    "cvss_score": 10,
    "date_added": "2023-10-17",
    "vendor_project": "Cisco",
    "patch_available": true,
    "ransomware_linked": false,
    "vulnerability_name": "Cisco IOS XE Web UI Privilege Escalation"
   }
  ],
  "kev_count": 14,
  "priority_analysis": {
   "patch_immediately": [
    "CVE-2023-20198 (CVSS 10.0, due 2023-11-17)"
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-cisa-kev-lookup-patch-prioritization-07407fe3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse.theaslangroupllc.com](https://www.zero.xyz/host/cyberpulse.theaslangroupllc.com/llms.txt)