🛡️ CISA KEV Remediation Deadline & EPSS Radar

Turn the official CISA Known Exploited Vulnerabilities catalog into a prioritized remediation queue. This Actor focuses on operational deadlines: it calculates overdue status and days remaining, then enriches each actively exploited CVE with FIRST EPSS probability and ransomware-use evidence.

It is designed for vulnerability-management teams, MSSPs, security operations, cyber insurers, compliance teams, and scheduled AI-agent workflows.

How this differs from a generic KEV scraper

A catalog search tells you which vulnerabilities exist. This Actor tells you what needs attention first:

• rolling CISA remediation deadline window;
• overdue and due-today detection;
• daysUntilDue calculated on every run;
• FIRST EPSS exploit probability and percentile;
• known ransomware campaign filtering;
• deterministic critical, high, medium, or low priority;
• vendor, product, keyword, and catalog-added-date filters.

Example input

{
  "dueWithinDays": 30,
  "includeOverdue": true,
  "overdueWithinDays": 30,
  "addedWithinDays": 0,
  "vendors": ["Microsoft", "Cisco", "Fortinet"],
  "products": [],
  "keywords": [],
  "ransomwareOnly": false,
  "minimumEpss": 0.1,
  "maxItems": 100
}

The date window is relative to the day of each run, so the same input works on an Apify schedule without maintenance.

Example output

{
  "cveId": "CVE-2026-12345",
  "vendorProject": "Example Vendor",
  "product": "Example Product",
  "vulnerabilityName": "Example vulnerability",
  "dateAdded": "2026-08-20",
  "dueDate": "2026-09-10",
  "daysUntilDue": 10,
  "deadlineStatus": "upcoming",
  "knownRansomwareCampaignUse": true,
  "epssScore": 0.82,
  "epssPercentile": 0.99,
  "priority": "critical",
  "requiredAction": "Apply mitigations per vendor instructions.",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
  "cisaCatalogUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}

The example illustrates the schema and is not a real vulnerability record.

Priority rules

Priority	Rule
Critical	Overdue, known ransomware use, or EPSS ≥ 0.70
High	Due within 7 days or EPSS ≥ 0.30
Medium	Other matching KEV entries
Low	Due more than 30 days away and EPSS below 0.10

These labels are a consistent triage aid, not a replacement for asset exposure, business impact, or your organization's risk model.

Automation recipe

Run daily and route the dataset to Slack, email, a ticketing system, SIEM, SOAR, Make, Zapier, webhook, or an MCP-compatible AI client. Use cveId as the stable deduplication key and alert again when deadlineStatus or priority changes.

💰 Pricing

Pay only for matching findings written to the dataset. Filters run before charging, maxItems caps paid results, and Apify's maximum-charge limit can cap total run cost. No proxy, CISA key, NVD key, or FIRST API key is required. See the Pricing tab for the current event rate.

🔎 Data sources

• CISA KEV JSON: official list of vulnerabilities known to be exploited in the wild, read from CISA's official cisagov/kev-data mirror with the CISA website feed as fallback.
• FIRST EPSS: probability estimate for exploitation activity in the next 30 days; a score may be unavailable for a very new CVE.
• CISA due dates are binding guidance for US Federal Civilian Executive Branch agencies under BOD 22-01, but other organizations use them as prioritization signals.
• Verify remediation instructions with CISA and the affected vendor. This Actor does not scan assets and does not prove that your systems are vulnerable.

Support

Open an issue with the CVE ID and a description of the unexpected field. Do not include internal asset inventories, tokens, or credentials.

📥 Complete input reference

Field	Type	Default	Purpose
dueWithinDays	integer	30	Rolling remediation window starting today. Use 0 to return only items due today or overdue.
includeOverdue	boolean	true	Include KEV entries whose CISA remediation deadline has already passed.
overdueWithinDays	integer	30	Limit overdue findings to deadlines missed within this many days, preventing years-old KEVs from overwhelming the queue.
addedWithinDays	integer	0	Optionally include only vulnerabilities added to KEV within this many days. Zero disables this filter.
vendors	array	—	Optional case-insensitive vendor filters, for example Microsoft, Cisco, or Fortinet.
products	array	—	Optional case-insensitive product filters.
keywords	array	—	Match any keyword across CVE ID, vendor, product, name, description, and required action.
ransomwareOnly	boolean	false	Return only vulnerabilities CISA associates with known ransomware campaigns.
minimumEpss	number	0	Minimum FIRST EPSS score from 0 to 1. Zero keeps entries without an EPSS score.
maxItems	integer	100	Maximum matching rows written and charged.

📤 Complete output reference

The default dataset is exportable as JSON, CSV, Excel, XML or RSS. Fields remain stable for scheduled runs and API integrations.

Field	Type
cveId	string
vendorProject	string
product	string
vulnerabilityName	string
dateAdded	string
dueDate	string
daysUntilDue	integer
deadlineStatus	string
knownRansomwareCampaignUse	boolean
epssScore	number
epssPercentile	number
priority	string
shortDescription	string
requiredAction	string
notes	string
cwes	array
nvdUrl	string
cisaCatalogUrl	string
sourceCatalogVersion	string
sourceCatalogReleased	string

🔌 API & integrations

Run this Actor from the Apify Console, API, CLI, MCP, Make, Zapier or n8n. Replace the Actor identifier and token in this template:

curl -X POST "https://api.apify.com/v2/acts/cisa-kev-remediation-radar/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

Results are stored in the run's default dataset and can be forwarded with Apify webhooks or scheduled Tasks.

🔎 Search keywords

CISA KEV Remediation Deadline & EPSS Radar, cisa, kev, remediation, deadline, epss, radar, Apify Actor, scraper API, structured data, scheduled monitor, automation.