Is this CVE actually being exploited? Check KEV, EPSS and CVSS in under a minute

A new CVE lands in your feed, or a scan report comes back with 400 "Critical" findings. The question that actually decides what you do next is not "how bad could this be?" It is "is anyone using this right now?"

You can answer that in under a minute with three free, public data sources. Here is how to check each one yourself, from the command line, and how to read the answers together.

1. CISA KEV: is it being exploited right now?

The US Cybersecurity and Infrastructure Security Agency keeps the Known Exploited Vulnerabilities (KEV) catalog: CVEs with reliable evidence of active exploitation. It is short (1,766 entries as of 30 October 2026, out of hundreds of thousands of CVEs), so a match means something.

CISA publishes the whole catalog as one JSON file:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json

jq -r '.vulnerabilities[] | select(.cveID=="CVE-2021-44228") | "\(.cveID) on KEV since \(.dateAdded), ransomware use: \(.knownRansomwareCampaignUse)"' kev.json

CVE-2021-44228 on KEV since 2021-12-10, ransomware use: Known

No output means the CVE is not on the list. That is not proof it is safe; it means nobody has confirmed exploitation to CISA's standard yet.

2. EPSS: how likely is exploitation soon?

The Exploit Prediction Scoring System, published daily by FIRST, estimates the probability that a CVE is exploited in the next 30 days. It has a free API that needs no key:

curl -s "https://api.first.org/data/v1/epss?cve=CVE-2021-44228" | jq -r '.data[0] | "EPSS \(.epss)  percentile \(.percentile)  (\(.date))"'

EPSS 0.999990000  percentile 1.000000000  (2026-10-31)

Read it as a probability: 0.05 is 5%. Most CVEs score well under 1%, so anything in the top few percentiles deserves attention even if it isn't on KEV yet. Scores change daily, so check again rather than caching last month's number.

3. CVSS: how bad would it be?

CVSS is the 0 to 10 severity score most scanners lead with. The NVD API returns it:

curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228" | jq -r '.vulnerabilities[0].cve.metrics.cvssMetricV31[0].cvssData.baseScore'

10.0

CVSS tells you the damage if exploited. It does not tell you whether anyone will bother, which is why thousands of 9.8s sit untouched for years while a 7.5 on KEV gets used in ransomware campaigns.

Putting the three together

A simple, defensible order for any list of findings:

1. On KEV: fix first. Someone is using it.
2. High EPSS (say, top 5% by percentile): fix next. Exploitation is likely soon.
3. Everything else, by CVSS: schedule by severity and exposure.

That order also makes reports easier to defend. "We fixed these 6 first because CISA confirms they are being exploited" lands better with a client or manager than "we fixed the reds."

A few gotchas worth knowing:

• Scanner exports often leave CVEs out. Some checks only carry a vendor ID (an OpenVAS OID or a Nessus plugin ID), so a CVE-based lookup misses them unless you map the ID first.
• KEV has a sibling list. VulnCheck publishes its own KEV with more entries and faster additions; worth a look if CISA's list feels slow.
• EPSS is per CVE, not per host. An internet-facing server and an isolated lab box get the same score. Exposure is still your call.

Skip the terminal

If you'd rather paste a CVE into a box, we built a free CVE checker that runs all three lookups at once and gives a plain-English answer on how urgently to fix it. No account, nothing stored. It sits alongside our other free tools (DMARC, SPF, DKIM and MX checks, and a DMARC record generator).

For the longer background, see What is CISA KEV? and What is EPSS?.

Drafted with AI assistance. Every command above was run against the live APIs on 31 October 2026 before publishing.