CISA Known Exploited Vulnerabilities

Threat Intelligence

Overview

The CISA Known Exploited Vulnerabilities (KEV) Connector integrates with the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog data feed. The catalog is a public, authoritative list of CVEs that CISA has confirmed are being actively exploited in the wild, along with the remediation action and federal compliance due date for each.

The connector downloads the catalog feed (a single JSON document, optionally gzip-compressed), parses every catalog entry, and emits one Exploited Vulnerability record per CVE. These records map to the Brinqa Unified Data Model (UDM) CveRecord model, enriching CVE records in the platform with CISA's actively-exploited flag, the CISA-mandated remediation action, the federal remediation due date, the weakness classifications CISA assigns, and the reference links CISA publishes. This connector is a Threat Intelligence data source.

Data retrieved from CISA Known Exploited Vulnerabilities

Connector Object	Required	Maps to Data Model
Exploited Vulnerability	Yes	Cve Record

Model relationships

note

For detailed steps on how to view the data retrieved from CISA Known Exploited Vulnerabilities in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select CISA Known Exploited Vulnerabilities from the Connector dropdown and provide the following:

Setting	Required	Default	Description
CISA URL	Yes	https://www.cisa.gov	CISA data feeds base URL
Max retries	No	5	The maximum number of retry attempts before giving up a request, 1 to 20, defaulting to 5. A value outside this range is ignored and leaves the default in place.

Authentication

Method: None. The CISA KEV catalog feed is a public, unauthenticated resource. No API key, token, or credentials are required. The connector issues a plain HTTPS GET against the configured CISA base URL and identifies itself with an X-Requested-With header.

Endpoint

Method	URL
GET	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Request Headers

Header	Value
X-Requested-With	brinqa

Request Body

None. The feed is retrieved with a GET request and no body.

Sample Response

The feed returns a single catalog object containing publication metadata and an array of vulnerabilities:

{
  "title": "CISA Catalog of Known Exploited Vulnerabilities",
  "catalogVersion": "2026.09.16",
  "dateReleased": "2026-09-16T18:47:50.6796Z",
  "count": 1713,
  "vulnerabilities": [
    {
      "cveID": "CVE-2026-58704",
      "vendorProject": "Google",
      "product": "Pixel",
      "vulnerabilityName": "Google Pixel Improper Authorization Vulnerability",
      "dateAdded": "2026-09-16",
      "shortDescription": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem.",
      "requiredAction": "Apply mitigations in accordance with vendor instructions.",
      "dueDate": "2026-09-19",
      "knownRansomwareCampaignUse": "Unknown",
      "forensicTriage": "Yes",
      "notes": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-58704",
      "cwes": [
        "CWE-693"
      ]
    }
  ]
}

Response Fields

Field	Type	Description
title	String	Human-readable title of the published catalog.
catalogVersion	String	Version identifier of the published catalog.
dateReleased	Instant	Timestamp the catalog version was released.
count	Integer	Number of entries in the published catalog.
vulnerabilities	Array	Exploited vulnerability entries (see Attribute Mapping below).

Usage

No token is issued, stored, or reused. Because the feed is anonymous, every sync is a fresh unauthenticated GET; the only header carried on subsequent requests is the identification header:

X-Requested-With: brinqa

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records added after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain CISA Known Exploited Vulnerabilities credentials

Obtain the required credentials (url) from your CISA Known Exploited Vulnerabilities administrator or the CISA Known Exploited Vulnerabilities admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Exploited Vulnerability

Source Field Name	SDM Attribute
connector runtime	LAST_CAPTURED
constant true	EXPLOITED
VulnerabilityResource.cveID	UID
VulnerabilityResource.cwes	CWE_IDS
VulnerabilityResource.cwes	WEAKNESSES
VulnerabilityResource.dateAdded	Date added
VulnerabilityResource.dueDate	DUE_DATE
VulnerabilityResource.forensicTriage	FORENSIC_TRIAGE
VulnerabilityResource.knownRansomwareCampaignUse	KNOWN_RANSOMWARE_CAMPAIGN_USE
VulnerabilityResource.notes	NOTES
VulnerabilityResource.notes	REFERENCES
VulnerabilityResource.product	Product
VulnerabilityResource.requiredAction	Action
VulnerabilityResource.shortDescription	DESCRIPTION
VulnerabilityResource.vendorProject	Vendor or project
VulnerabilityResource.vulnerabilityName	NAME

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Exploited Vulnerability

Operation options

Option	Type	Default	Description
maxRetries	Integer	the configured maxRetries	Overrides the configured retry count for a single operation.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on dateAdded.

API

• Type: REST endpoint · Endpoint: GET /sites/default/files/feeds/known_exploited_vulnerabilities.json
• Default filters: None — the feed is a single static document with no query interface

note

• The catalog publishes no per-entry modification timestamp, so dateAdded is the only incremental signal available. An entry that carries no dateAdded is always emitted rather than being dropped from a delta sync.
• A response that omits the vulnerabilities array is treated as a malformed feed and fails the sync, rather than being reported as a successful run that found no records.

Changelog

Changelog

The CISA Known Exploited Vulnerabilities connector has undergone the following changes:

Version	Description	Migration Steps
3.0.6	New Features - Exploited Vulnerability records now carry the weakness classifications CISA publishes for each CVE, so catalog entries correlate with Weakness records in the platform. - Added the reference links CISA publishes with each catalog entry (vendor advisories, binding operational directives, and the NVD record), together with the original note text they are taken from. - Added "Known ransomware campaign use", reporting whether CISA has observed the CVE used in ransomware campaigns, and "Forensic triage", reporting whether CISA's forensic triage requirements apply to it. - Added "Last captured" to every Exploited Vulnerability record, recording when the connector read the entry from the catalog. - Added a Max retries setting that controls how many times a catalog feed request is retried before the sync gives up. It defaults to 5 and accepts values from 1 to 20. Improvements - Testing the connection now retrieves the catalog feed instead of passing unconditionally, so an unreachable or misconfigured CISA URL is reported when the data source is tested rather than at the next sync. - Catalog downloads are now retried with backoff. The feed is a single large download with no way to resume part-way, so a transient network or CDN error previously cost the entire sync. - When the feed cannot be retrieved, the reported error now identifies the requested feed path and the response CISA returned, instead of a bare connection failure. - The CISA URL is now validated when the data source is saved, so a blank or malformed URL is rejected at configuration time rather than failing during a sync. Bug Fixes - Fixed an error that prevented the connector's data model schema from loading. Configuring a CISA Data Integration failed with an internal server error instead of listing the available models; schema retrieval now completes successfully.	N/A
3.0.5	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.3	Improvements - Standardized the "Date added" field so the date a vulnerability was added to the CISA catalog is now represented as a true date/time value, enabling consistent date-based filtering, sorting, and reporting.	• Exploited Vulnerability: The "Date added" attribute changed from a numeric value to a date/time type. Action: re-sync the connector so existing records are refreshed with the updated field type.
3.0.2	Improvements - Simplified how each Exploited Vulnerability record is uniquely identified, making correlation of catalog entries more reliable and consistent with platform conventions.	• Exploited Vulnerability: The record identifier configuration changed. Action: re-sync the connector so existing records are matched and updated correctly.
3.0.1	Improvements - Improved the field and identifier mappings for Exploited Vulnerability records so the "Due date" and "Exploited" fields and record correlation align with current platform standards.	• Exploited Vulnerability: The record identifier mapping changed. Action: re-sync the connector so existing records are matched and updated correctly.
3.0.0	Overview The CISA Known Exploited Vulnerabilities connector integrates with the CISA Known Exploited Vulnerabilities (KEV) Catalog to synchronize the authoritative list of vulnerabilities that are known to be actively exploited in the wild. Category: Threat Intelligence Models	N/A