# fittings CISA KEV Status

> fittings CISA KEV Status is a paid API for AI agents from fittings.sh, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-11).

Checks whether a given CVE is listed in CISA's Known Exploited Vulnerabilities catalog and returns the date added, federal remediation due date, and required action.

## Facts

- Endpoint: GET https://fittings.sh/v1/kev/status?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fittings-cisa-kev-status-c8665af0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H5AuNDcMto2TSpYT859i_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fittings-cisa-kev-status-c8665af0
```

Example prompt: Is CVE-2021-44228 (Log4Shell) in CISA's Known Exploited Vulnerabilities catalog? If so, tell me when it was added, what the federal remediation due date is, and what action CISA requires.

## When to prefer this

Use this endpoint when you need a fast, authoritative lookup of whether a specific CVE has been added to CISA's Known Exploited Vulnerabilities catalog, including the exact federal remediation deadline and required action. Prefer it over EPSS scoring (which gives exploit probability) when you need compliance-driven, government-mandated status rather than statistical risk modeling. Ideal for security workflows, compliance audits, and patch prioritization pipelines.

## Known failure modes

- CVE not found in KEV catalog (returns not-present status rather than error)
- Malformed or non-existent CVE identifier returns an error
- Network or upstream CISA data source unavailability
- Rate limiting or payment failure for the $0.003 per-call fee

## How this service works

Whether a CVE is in CISA’s Known Exploited Vulnerabilities catalog, with the date added, the federal remediation due date and the required action.

## Output

Returns whether the CVE is present in CISA's Known Exploited Vulnerabilities catalog, the date it was added to the catalog, the federal remediation due date mandated for government agencies, and the specific required action CISA has prescribed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "cve"
     ],
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE identifier, e.g. CVE-2021-44228"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fittings-cisa-kev-status-c8665af0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from fittings.sh](https://www.zero.xyz/host/fittings.sh/llms.txt)