CISA KEV Remediation Calendar

This Actor fetches the public CISA Known Exploited Vulnerabilities (KEV) catalog from CISA's publisher-maintained JSON mirror and turns matching records into structured remediation-calendar rows.

It preserves CISA-published cveID, vendorProject, product, vulnerabilityName, dateAdded, dueDate, requiredAction, and knownRansomwareCampaignUse. It calculates only two planning aids:

• urgency, from the CISA due date at the time of retrieval;
• internalSlaDueDate, from the CISA date added plus your selected internal SLA days.

The Actor does not infer CVSS, severity, exploitability, ransomware use, or regulatory conclusions. CISA remains the source of truth for the catalog fields.

Default run

The Store default is a live, bounded CISA catalog fetch (sourceMode: live, maxItems: 1). It does not fall back to generated, synthetic, or placeholder output if the publisher source is unavailable. A failed live request fails the run transparently.

{
  "sourceMode": "live",
  "maxItems": 1,
  "internalSlaDays": 14,
  "deltaMode": "all"
}

Use vendors and products for case-insensitive CISA-field substring filters. Leave both empty to emit the earliest matching catalog records by CISA due date.

Delta runs

Set deltaMode to newSincePriorRun to save the emitted CVE IDs under stateKey and emit only new matching CVEs on subsequent runs. The first delta run is labeled firstRun; it is not presented as a catalog change claim.

Output

Each record includes the CISA publication fields, a calendar object, the calculated planning fields, deltaType, CISA source URL, catalog version, and retrieval time. The package's captured fixture exists only for deterministic source tests; it is explicitly labeled capturedFixture and is not evidence of a live run.

Sources

• CISA KEV catalog page
• CISA publisher-maintained KEV JSON mirror

The checked-in captured source fixture records the 2026.09.04 catalog artifact SHA-256 f92f4cef4bba9b8c69c1a34deeb825af3810ffb6a0447042d16df894751da2cf for package verification only.