CISA KEV Watchlist for a Stable Triage Queue

See it before you configure it

A closer look at the workflow.

Saved sample · October 9, 2026
This preview makes no live data requests.

Inspect the records

CISA KEV watchlists · observed October 9, 2026
CVE identity	Published vendor	Published product	Added to KEV	CISA published due date	Published ransomware use
CVE-2023-27350	PaperCut	MF/NG	2023-04-21	2023-05-12	Known
CVE-2021-44228	Apache	Log4j2	2021-12-10	2021-12-24	Known

Historical catalog observations for PaperCut and Log4j2. Comparison was off in the source run. EPSS fields are intentionally omitted from this preview; no score or asset exposure is inferred.

Download sample CSV Download sample JSON

Start with a focused input

{
  "vendors": [],
  "products": [],
  "cveIds": [
    "CVE-2021-44228",
    "CVE-2023-27350"
  ],
  "includeEpss": false,
  "maxResults": 5,
  "comparePrevious": true,
  "onlyChanges": false,
  "snapshotName": "n8n-kev-manual-v1",
  "maxRunSeconds": 120
}

Download input JSON

The saved preview and sample downloads make no live requests. Running an Actor is a separate, user-initiated action on Apify; review its current pricing and set a maximum total charge first. Input row limits are not spending caps.

Keep one identity per record

CVE-keyed catalog observations ready for your triage register, with asset review and ticket updates left to your own process.

DESTINATION KEYcveId

Keep the originating run ID and dataset; upsert by cveId and deduplicate retries by run ID plus cveId. Never auto-close from a missing observation.

The template produces flat rows. Connect your own spreadsheet or service desk and use this key when updating records.

Get the n8n template

From first run to repeatable work

Make it part of your process.

01
Start with exact CVE IDs
Import the inactive n8n starter and keep the two example CVEs or supply your own small watchlist. EPSS is off and output is capped at five rows. Choose your own snapshotName and select your Apify Header Auth credential on all five HTTP Request nodes.
02
Establish a reviewed baseline
Review pricing, then run once manually. The starter requests a $0.15 charge ceiling and checks SUMMARY plus the complete saved dataset count. Separately reconcile matchingCatalogRecords with rowsSaved plus unchangedSkipped before treating all matched watchlist records as checked.
03
Upsert a stable triage item
The starter prepares flat rows with cveId as record_key. Add your own destination connection and retain requiredAction, source link and observedAt. Create asset_match, review_owner and review_status yourself; these are not fields supplied by the starter.
04
Review changes in context
Repeat the same watchlist and snapshotName sequentially. First comparison rows are new to saved history, not newly disclosed vulnerabilities. Enable onlyChanges after bootstrap if appropriate, and have a reviewer check actual assets and versions before acting on changedFields and previous.

Understand the output

Fields with a clear purpose.

cveId: One destination triage key per CVE.
vendor / product / matchedWatchlist: Publisher software labels and exact matching evidence; not installed-asset exposure.
dateAdded / publishedDueDate: Catalog inclusion date and CISA's source due-date field. Neither is a deadline calculated for your organization.
requiredAction / knownRansomwareCampaignUse: Published action text and ransomware-use label, preserved in source context.
changedFields / previous / url / observedAt: Saved catalog comparisons and source evidence for review.

Before you rely on a result

Check the coverage.

Require healthy SUMMARY status with incomplete false and no failedSources.
Confirm sourcesSucceeded is 1 and there is no time/spending/history failure.
Before claiming the matched scope is checked, reconcile matchingCatalogRecords with rowsSaved + unchangedSkipped.

Source and workflow limits

This is a public catalog watchlist, not an asset scanner, exploitability test or remediation guarantee.
Vendor and product terms are literal case-insensitive substring matches. Populated vendor, product, exact CVE and date filters combine with AND.
A clean empty or unchanged run is valid, but source/time/spending/history failures require review. Do not infer safety or deletion from absence.
History advances only after confirmed saves. Keep one writer per scope and replay the original dataset if delivery fails.
The starter stops at prepared rows. A service-desk connection, ticket decisions and recurrence require your own setup; that customer connection has not been exercised end to end.

Common questions

A few useful answers.

Does a KEV match prove an installed asset is vulnerable?

No. The Actor does not scan assets or inspect installed versions. A reviewer must relate the CVE to the organization's own inventory and context.

What does new mean in the first comparison?

New to that saved watchlist scope. It does not mean newly disclosed or newly added to CISA KEV. dateAdded is the catalog inclusion date.

Does an absent CVE mean a system is safe?

No. KEV is a selected catalog. An unmatched or unchanged watchlist can return zero rows; neither condition should automatically close tickets.

Does an EPSS-only change create a catalog alert?

No. EPSS is optional and excluded from the Actor's catalog-change hash. This example leaves EPSS off.

Can the Actor set my remediation deadlines?

No. publishedDueDate preserves CISA's catalog value in its source context. Maintain organization deadlines separately and review the applicable source guidance.

Ready for your own data?

Start with a small scope.

Review current pricing and coverage, then configure your input on Apify.

Open Actor on Apify

Sources & further reading

Guide prepared October 13, 2026. Samples are dated observations; current source records can differ.