How to check your scan results against CISA KEV from the command line

#security #cybersecurity #bash #devops

Drafted with AI assistance. Every command below was run on 6 November 2026 (jq 1.7) against the live CISA KEV feed, FIRST's EPSS API and a sample Nessus CSV export before publishing.

A scan report can list hundreds of CVEs. CISA's Known Exploited Vulnerabilities (KEV) catalog tells you which of them attackers are actually using, and FIRST's EPSS score estimates how likely the rest are to be exploited soon. Here's how to check your own scan export against both with grep, sort, comm, curl and jq (1.6 or later).

1. Pull the CVE IDs out of your export

This works on a Nessus CSV or .nessus file, an OpenVAS/Greenbone XML report, a Qualys or Rapid7 CSV, or a JSON export. It doesn't parse the format. It just finds every string that looks like a CVE ID.

grep -ohE 'CVE-[0-9]{4}-[0-9]{4,}' scan-export.csv | LC_ALL=C sort -u > scan-cves.txt
wc -l < scan-cves.txt

To check several exports at once, list them all after grep (or use *.csv). LC_ALL=C keeps every sort in the same order, which comm needs in step 3.

2. Download the KEV catalog

curl -s -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
jq -r '.catalogVersion, .count' kev.json
jq -r '.vulnerabilities[].cveID' kev.json | LC_ALL=C sort -u > kev-cves.txt

On 6 November 2026 the catalog was version 2026.11.04 with 1,768 entries. CISA adds entries several times a week, so grab a fresh copy each time.

3. Find the CVEs that are on KEV

comm -12 prints only the lines found in both sorted lists: the CVEs in your scan that are known to be exploited.

LC_ALL=C comm -12 scan-cves.txt kev-cves.txt > on-kev.txt

# CVE, vendor, product, date added, due date, ransomware use (tab-separated)
jq -r --rawfile ids on-kev.txt '($ids | split("\n") | map(select(length > 0))) as $l
  | .vulnerabilities[] | select(.cveID | IN($l[]))
  | [.cveID, .vendorProject, .product, .dateAdded, .dueDate, .knownRansomwareCampaignUse] | @tsv' kev.json

Our sample export had 6 unique CVEs, and 3 were on KEV: CVE-2024-3400 (Palo Alto PAN-OS), CVE-2021-44228 (Log4j) and CVE-2023-4863 (Chromium WebP). The first two are marked Known for ransomware use.

4. See which hosts have them

# Every row that mentions a KEV CVE
grep -F -f on-kev.txt scan-export.csv

# Just CVE and host, using Nessus's default CSV columns (CVE = 2, Host = 5)
grep -F -f on-kev.txt scan-export.csv | cut -d, -f2,5 | LC_ALL=C sort -u

If you changed the columns, or your scanner uses a different layout, check the header row and adjust the numbers.

5. Rank everything by EPSS

FIRST's EPSS API takes up to 100 CVEs per request and needs no key. This splits the list into groups of 100, so it works for a scan of any size:

split -l 100 scan-cves.txt chunk_
for f in chunk_*; do
  curl -s "https://api.first.org/data/v1/epss?cve=$(paste -sd, "$f")&limit=100"
done | jq -rs '[.[].data[]] | sort_by(-(.epss | tonumber)) | .[] | [.cve, .epss, .percentile] | @tsv'

# The CVEs that are not on KEV, to work through next
LC_ALL=C comm -23 scan-cves.txt kev-cves.txt

In our sample, the three KEV entries all scored above 0.99. Of the rest, SSH Terrapin (CVE-2023-48795) scored 0.94, well above the two OpenSSL CVEs at 0.04 and 0.02. That puts it next in line, even though its CVSS score was the lowest of the three.

KEV first, whatever the EPSS score. A CVE on KEV is being exploited now, even if its EPSS score is low. EPSS estimates exploitation across the whole internet over the next 30 days, so a narrowly targeted appliance bug can score low and still be on KEV.

Putting it to use

Treat KEV's dueDate as your target for anything internet-facing. US federal agencies get anywhere from a few days to three weeks.
Re-run steps 2 and 3 when CISA adds entries. A CVE you deferred last week can be on KEV today.
Keep the TSV output with the scan. A dated list of exploited CVEs and the hosts that had them is useful evidence for audits and client reviews.
Findings with no CVE (weak TLS settings, default credentials) won't show up here. Review those in the report itself.

If comm complains a file isn't sorted, re-create both lists with LC_ALL=C sort -u. If jq says IN or --rawfile isn't defined, your jq is older than 1.6.

The original version of this guide lives on varaxontech.com. To follow what CISA adds each month, see how to track KEV additions with curl and jq. We built Varaxon Scan Hub to run these KEV and EPSS checks on every finding when you upload a scan export.

DEV Community