skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-cve-prioritization-with-kev-catalog

Prioritize CVE remediation using CISA KEV, EPSS, and CVSS scoring data.

954|172|Updated Mar 13, 2026
Search Tags:#remediation#threat intelligence#cvss#cve#vulnerability prioritization#epSS#CISA KEV
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-cve-prioritization-with-kev-catalog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cve-prioritization-with-kev-catalog
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/vulnerability-management/performing-cve-prioritization-with-kev-catalog
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-cve-prioritization-with-kev-catalog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, pandas.

What problem does it solve?

Security teams face thousands of CVEs from vulnerability scanners and cannot patch everything at once. This Skill replaces CVSS-only triage with a risk-based model that prioritizes vulnerabilities with confirmed real-world exploitation evidence, so teams fix what attackers are actually using first.

Core Features & Use Cases

  • KEV Catalog Integration: Fetch and parse the CISA Known Exploited Vulnerabilities JSON feed, including ransomware campaign flags and BOD 22-01 due dates.
  • Multi-Factor Risk Scoring: Combine KEV listing (30%), EPSS probability (25%), CVSS base score (20%), asset criticality (15%), and network exposure (10%) into a composite risk score.
  • Priority Assignment with SLAs: Map findings to P1-Emergency through P5-Low tiers with defined remediation deadlines, and generate a sorted CSV report.
  • Use Case: After a Nessus scan returns 500 CVEs, run the prioritization engine to immediately surface the 12 KEV-listed vulnerabilities (including 2 tied to ransomware campaigns) as P1 items due within 48 hours.

Quick Start

Fetch the latest CISA KEV catalog and prioritize the CVEs from my vulnerability scan results using KEV, EPSS, and CVSS scores.

Frequently Asked Questions about performing-cve-prioritization-with-kev-catalog

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize CVEs using the CISA KEV catalog?▼

Download the KEV JSON feed from CISA, match your scan results against listed CVE IDs, and treat any KEV-listed vulnerability as P1-Emergency regardless of CVSS score. Then enrich remaining CVEs with EPSS and CVSS data to assign lower priority tiers.

What is the difference between KEV, EPSS, and CVSS for vulnerability prioritization?▼

KEV confirms a CVE is actively exploited in the wild, EPSS predicts the probability of future exploitation, and CVSS measures intrinsic technical severity. Combining all three produces a risk-based ranking instead of relying on severity alone.

How often should the CISA KEV catalog be refreshed?▼

Refresh the KEV catalog daily because CISA adds new entries multiple times per week. Stale catalog data causes newly exploited vulnerabilities to be missed during prioritization runs.

Does a high EPSS score matter if a CVE is not in the KEV catalog?▼

Yes. High-EPSS non-KEV CVEs should still escalate because cataloging lags actual exploitation. A CVE with EPSS above 0.5 and CVSS 9.0 or higher maps to P1-Emergency even without a KEV listing.

What are the BOD 22-01 remediation deadlines for KEV vulnerabilities?▼

For CVEs published in 2021 or later, federal agencies must remediate within 2 weeks of KEV listing; CVEs published before 2021 have a 6-month deadline. Track these due dates separately for FCEB compliance reporting.

What Python libraries are needed for KEV-based vulnerability prioritization?▼

The workflow requires Python 3.8+ with the requests library for calling the CISA KEV, EPSS, and NVD APIs, and pandas for building, sorting, and exporting the prioritized vulnerability report to CSV.

Related Skills

Explore More Software Engineering Skills→
BagelHoleBagelHole
46

vulnerability-scanning

Scan systems and dependencies for CVEs using Nessus, OpenVAS, and Qualys.

Community
Intermediate
brainbrewlabsbrainbrewlabs
7

ticket-routing

Route classified support tickets to teams using routing tables and SLA targets.

Official
Intermediate
jaskaranhundaljaskaranhundal
3

continuous-pentesting

Assess and prioritize attack surface testing based on exploitability and threat actor usage.

Community
Advanced
DCx7C5DCx7C5

vulnerabilities-SKILL.md

Prioritize CVEs by CVSS scores enriched with EPSS and KEV data.

Community
Advanced