--- type: "firecrawl-provider" description: "CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's public JSON feed on www.cisa.gov, keyless: check up to 100 CVE ids for KEV membership, search and browse the catalog by vendor, product, text, CWE, ransomware use, forensic triage and added or due dates, and list what CISA added in the last days. Each entry carries the date added, federal due date and required action, known ransomware campaign use, the BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links and CWEs, plus the catalog version. Adds over nvd-nist-gov (an in_kev flag and three KEV fields that lag CISA) and osv-dev (no KEV data): same-day additions, ransomware and forensic triage, notes, catalog browsing and vendor grouping." use_when: "CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's public JSON feed on www.cisa.gov, keyless: check up to 100 CVE ids for KEV membership, search and browse the catalog by vendor, product, text, CWE, ransomware use, forensic triage and added or due dates, and list what CISA added in the last days. Each entry carries the date added, federal due date and required action, known ransomware campaign use, the BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links and CWEs, plus the catalog version. Adds over nvd-nist-gov (an in_kev flag and three KEV fields that lag CISA) and osv-dev (no KEV data): same-day additions, ransomware and forensic triage, notes, catalog browsing and vendor grouping." categories: "Developer" capabilities: 3 credits_per_call: 5 --- # CISA Known Exploited Vulnerabilities (KEV) catalog on Firecrawl Alexandria CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's public JSON feed on www.cisa.gov, keyless: check up to 100 CVE ids for KEV membership, search and browse the catalog by vendor, product, text, CWE, ransomware use, forensic triage and added or due dates, and list what CISA added in the last days. Each entry carries the date added, federal due date and required action, known ransomware campaign use, the BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links and CWEs, plus the catalog version. Adds over nvd-nist-gov (an in_kev flag and three KEV fields that lag CISA) and osv-dev (no KEV data): same-day additions, ransomware and forensic triage, notes, catalog browsing and vendor grouping. - Categories: Developer - Category index: [Developer category](https://firecrawl.dev/alexandria/agents/categories/developer) - Provider key: `cisa-gov` - Access: Firecrawl credits - Cost: 5 credits per call ## More - [Human guide](https://firecrawl.dev/app/alexandria/cisa-gov) - [OpenAPI spec](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/openapi.json) ## Capabilities - [Kev lookup](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_lookup): Check up to 100 CVE ids against CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's feed: for each id, in_kev and the full KEV entry (vendor and product, vulnerability name, date added, federal due date and required action, known ransomware campaign use, BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links, CWEs), plus the catalog version and release time. What it adds over nvd-nist-gov and osv-dev: NVD carries only an in_kev flag with date added, due date and required action, and lags CISA by hours to days; it has no ransomware use, forensic triage, notes or catalog version. OSV has no KEV data. - [Kev recent](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_recent): CVEs CISA added to its Known Exploited Vulnerabilities (KEV) catalog in the last N days (default 7, 1 for today), read live from CISA's feed, newest first, with each full KEV entry (ransomware use, forensic triage, due date, required action, notes) and the catalog version, release time and count. What it adds over nvd-nist-gov and osv-dev: NVD's KEV fields appear only after NVD syncs, so new additions are missing or partial there for hours to days, and neither NVD nor OSV can list what CISA added on a given day. - [Kev search](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_search): Search and browse CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's feed: filter by vendor, product, free text over CVE id, name and description, CWE, known ransomware campaign use, BOD 26-04 forensic triage, date-added range and due-date range; paged, newest additions first. Accepts a pasted cisa.gov/known-exploited-vulnerabilities-catalog URL including its ?search_api_fulltext= and ?field_cve= forms. What it adds over nvd-nist-gov and osv-dev: catalog-wide browsing and vendor or product grouping (all KEVs for Ivanti), ransomware and forensic triage filters and CISA's notes, none of which NVD or OSV can query. ## 1. Choose this provider when CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's public JSON feed on www.cisa.gov, keyless: check up to 100 CVE ids for KEV membership, search and browse the catalog by vendor, product, text, CWE, ransomware use, forensic triage and added or due dates, and list what CISA added in the last days. Each entry carries the date added, federal due date and required action, known ransomware campaign use, the BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links and CWEs, plus the catalog version. Adds over nvd-nist-gov (an in_kev flag and three KEV fields that lag CISA) and osv-dev (no KEV data): same-day additions, ransomware and forensic triage, notes, catalog browsing and vendor grouping. ## 2. Minimal request Call `POST https://api.firecrawl.dev/v2/scrape` with `{ alexandria: { provider, capability, options } }`. For a batch, send `{ alexandria: [...] }` with up to 10 calls. ```json { "provider": "cisa-gov", "capability": "vulnerabilities/kev_lookup", "options": { "cve_ids": [ "CVE-2021-44228" ] } } ``` ## 3. Add provider options Use only the options needed for the task: - `cve_ids` (string[], required): CVE ids, e.g. CVE-2021-44228 (case-insensitive; duplicates are answered once). Example: `[]` ## 4. Request through your preferred interface ### JavaScript ```javascript const result = await firecrawl.scrape({ alexandria: { provider: "cisa-gov", capability: "vulnerabilities/kev_lookup", options: { cve_ids: [ "CVE-2021-44228", ], }, }, }); ``` ### Python ```python result = firecrawl.scrape_alexandria({ "provider": "cisa-gov", "capability": "vulnerabilities/kev_lookup", "options": { "cve_ids": [ "CVE-2021-44228" ] } }) ``` ### cURL ```sh curl https://api.firecrawl.dev/v2/scrape \ -H "Authorization: Bearer $FIRECRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "alexandria": { "provider": "cisa-gov", "capability": "vulnerabilities/kev_lookup", "options": { "cve_ids": [ "CVE-2021-44228" ] } } }' ``` ### CLI ```sh firecrawl scrape 'cisa-gov/vulnerabilities/kev_lookup' \ --options '{"cve_ids":["CVE-2021-44228"]}' ``` ### MCP Call the FCX MCP retrieve tool with this object: ```json { "provider": "cisa-gov", "capability": "vulnerabilities/kev_lookup", "options": { "cve_ids": [ "CVE-2021-44228" ] } } ``` Ask for only the returned fields needed by the task. ## 5. Full request shape ```json { "provider": "cisa-gov", "capability": "vulnerabilities/kev_lookup", "options": { "cve_ids": [ "CVE-2021-44228" ] } } ``` ## 6. Response data The response includes `success`, `provider`, `capability`, `creditsCost` and `data`. This example shows the provider payload in `data`: ```json { "catalog": { "catalog_version": "2026.10.23", "count": 1756, "date_released": "2026-10-23T19:30:18.9209Z", "title": "CISA Catalog of Known Exploited Vulnerabilities" }, "in_kev_count": 1, "observed_at_ms": 1792790027238, "requested": 1, "results": [ { "cve_id": "CVE-2021-44228", "entry": { "cve_id": "CVE-2021-44228", "cwes": [ "CWE-20", "CWE-400", "CWE-502" ], "date_added": "2021-12-10", "due_date": "2021-12-24", "forensic_triage": "No", "known_ransomware_campaign_use": "Known", "note_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ], "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "product": "Log4j2", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "vendor_project": "Apache", "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability" }, "in_kev": true } ], "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ``` ## API reference-derived contract The following capability contract is generated from the same normalized Alexandria API reference exposed in the API spec. ### Kev lookup - Capability: `vulnerabilities/kev_lookup` - Description: Check up to 100 CVE ids against CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's feed: for each id, in_kev and the full KEV entry (vendor and product, vulnerability name, date added, federal due date and required action, known ransomware campaign use, BOD 26-04 forensic triage flag, CISA's notes with vendor advisory links, CWEs), plus the catalog version and release time. What it adds over nvd-nist-gov and osv-dev: NVD carries only an in_kev flag with date added, due date and required action, and lags CISA by hours to days; it has no ransomware use, forensic triage, notes or catalog version. OSV has no KEV data. - Instructions: You have CVE ids and need to know whether they are known exploited, whether ransomware uses them, and what CISA requires and by when. - Cost: 5 credits per call - Capability file: [Kev lookup](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_lookup) Accepted options: - `cve_ids` (string[], required): CVE ids, e.g. CVE-2021-44228 (case-insensitive; duplicates are answered once). Example: `[]` Response schema example: ```json { "catalog": { "catalog_version": "2026.10.23", "count": 1756, "date_released": "2026-10-23T19:30:18.9209Z", "title": "CISA Catalog of Known Exploited Vulnerabilities" }, "in_kev_count": 1, "observed_at_ms": 1792790027238, "requested": 1, "results": [ { "cve_id": "CVE-2021-44228", "entry": { "cve_id": "CVE-2021-44228", "cwes": [ "CWE-20", "CWE-400", "CWE-502" ], "date_added": "2021-12-10", "due_date": "2021-12-24", "forensic_triage": "No", "known_ransomware_campaign_use": "Known", "note_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ], "notes": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", "product": "Log4j2", "required_action": "For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.", "short_description": "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "vendor_project": "Apache", "vulnerability_name": "Apache Log4j2 Remote Code Execution Vulnerability" }, "in_kev": true } ], "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ``` ### Kev recent - Capability: `vulnerabilities/kev_recent` - Description: CVEs CISA added to its Known Exploited Vulnerabilities (KEV) catalog in the last N days (default 7, 1 for today), read live from CISA's feed, newest first, with each full KEV entry (ransomware use, forensic triage, due date, required action, notes) and the catalog version, release time and count. What it adds over nvd-nist-gov and osv-dev: NVD's KEV fields appear only after NVD syncs, so new additions are missing or partial there for hours to days, and neither NVD nor OSV can list what CISA added on a given day. - Instructions: You need what CISA added to KEV today, this week or this month, or to answer a 'CISA adds N known exploited vulnerabilities' alert. - Cost: 5 credits per call - Capability file: [Kev recent](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_recent) Accepted options: - `cursor` (string): next_cursor from a previous page; it keeps that page's window. Example: `` - `days` (number): Window length in days, ending today on CISA's US Eastern calendar; 1 means added today. CISA adds entries most weekdays, not every day. Example: `7` - `page_size` (number): page_size Example: `100` Response schema example: ```json { "catalog": { "catalog_version": "2026.10.23", "count": 1756, "date_released": "2026-10-23T19:30:18.9209Z", "title": "CISA Catalog of Known Exploited Vulnerabilities" }, "next_cursor": "2026-09-24.2026-10-23.2026-10-20.CVE-2026-110936", "observed_at_ms": 1792790027242, "results": [ { "cve_id": "CVE-2026-114625", "cwes": [ "CWE-89" ], "date_added": "2026-10-23", "due_date": "2026-10-26", "forensic_triage": "Yes", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-114625" ], "notes": "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-114625", "product": "VeloCloud Orchestrator", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "short_description": "Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "vendor_project": "Arista", "vulnerability_name": "Arista VeloCloud Orchestrator SQL Injection Vulnerability" }, { "cve_id": "CVE-2026-110447", "cwes": [ "CWE-78" ], "date_added": "2026-10-23", "due_date": "2026-10-26", "forensic_triage": "Yes", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516", "https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-110447" ], "notes": "https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 ; https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110447", "product": "Collabora Online – Built-in CODE Server", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "short_description": "Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.", "vendor_project": "Collabora", "vulnerability_name": "Collabora Online – Built-in CODE Server OS Command Injection Vulnerability" }, { "cve_id": "CVE-2026-110936", "cwes": [ "CWE-427" ], "date_added": "2026-10-20", "due_date": "2026-11-03", "forensic_triage": "No", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://productcert.siemens.com/productcert/html/ssa-580366.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-110936" ], "notes": "https://productcert.siemens.com/productcert/html/ssa-580366.html ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-110936", "product": "Software Center", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "short_description": "Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.", "vendor_project": "Siemens", "vulnerability_name": "Siemens Software Center Uncontrolled Search Path Element Vulnerability" } ], "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "total_matches": 35, "window": { "days": 30, "from": "2026-09-24", "to": "2026-10-23" } } ``` ### Kev search - Capability: `vulnerabilities/kev_search` - Description: Search and browse CISA's Known Exploited Vulnerabilities (KEV) catalog, read live from CISA's feed: filter by vendor, product, free text over CVE id, name and description, CWE, known ransomware campaign use, BOD 26-04 forensic triage, date-added range and due-date range; paged, newest additions first. Accepts a pasted cisa.gov/known-exploited-vulnerabilities-catalog URL including its ?search_api_fulltext= and ?field_cve= forms. What it adds over nvd-nist-gov and osv-dev: catalog-wide browsing and vendor or product grouping (all KEVs for Ivanti), ransomware and forensic triage filters and CISA's notes, none of which NVD or OSV can query. - Instructions: You want every known exploited vulnerability for a vendor or product, those used by ransomware, those added or due in a date range, or the catalog page a user pasted. - Cost: 5 credits per call - Capability file: [Kev search](https://firecrawl.dev/alexandria/agents/providers/cisa-gov/vulnerabilities/kev_search) Accepted options: - `added_from` (string): Earliest date added, YYYY-MM-DD, inclusive. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `added_to` (string): Latest date added, YYYY-MM-DD, inclusive. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `cursor` (string): next_cursor from a previous page of the same search. Example: `` - `cwe` (string): CWE id, CWE-79 or 79. Pattern: ^\s*([Cc][Ww][Ee]-)?[0-9]{1,6}\s*$. Example: `` - `due_from` (string): Earliest federal due date, YYYY-MM-DD, inclusive. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `due_to` (string): Latest federal due date, YYYY-MM-DD, inclusive. Pattern: ^\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\s*$. Example: `` - `forensic_triage` (string): Yes keeps only CVEs that need forensic triage under BOD 26-04. Example: `Yes` - `known_ransomware_campaign_use` (string): Known keeps only CVEs CISA confirms are used in ransomware campaigns. Example: `Known` - `page_size` (number): page_size Example: `25` - `product` (string): Case-insensitive substring of the product: Connect Secure, Exchange Server, Log4j. Example: `` - `query` (string): Words that must all appear (case-insensitive) in the CVE id, vendor, product, vulnerability name or description: 'Roundcube', 'remote code execution', 'CVE-2024'. Example: `` - `url` (string): A pasted cisa.gov KEV catalog page, print page, /kev or feed URL; its search_api_fulltext and field_cve values join query. Pattern: ^https?://. Example: `` - `vendor` (string): Case-insensitive substring of the vendor or project: Ivanti, Microsoft, Apache. Example: `` Response schema example: ```json { "catalog": { "catalog_version": "2026.10.23", "count": 1756, "date_released": "2026-10-23T19:30:18.9209Z", "title": "CISA Catalog of Known Exploited Vulnerabilities" }, "next_cursor": "2026-05-07.CVE-2026-6973", "observed_at_ms": 1792790027239, "results": [ { "cve_id": "CVE-2026-104935", "cwes": [ "CWE-290" ], "date_added": "2026-10-13", "due_date": "2026-10-16", "forensic_triage": "Yes", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-104935" ], "notes": "https:/forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 ; https://nvd.nist.gov/vuln/detail/CVE-2026-104935", "product": "Connect Secure", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "short_description": "Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.", "vendor_project": "Ivanti", "vulnerability_name": "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability" }, { "cve_id": "CVE-2026-10520", "cwes": [ "CWE-78" ], "date_added": "2026-06-11", "due_date": "2026-06-14", "forensic_triage": "No", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-10520" ], "notes": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-10520", "product": "Sentry", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "short_description": "Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.", "vendor_project": "Ivanti", "vulnerability_name": "Ivanti Sentry OS Command Injection Vulnerability" }, { "cve_id": "CVE-2026-6973", "cwes": [ "CWE-20" ], "date_added": "2026-05-07", "due_date": "2026-05-10", "forensic_triage": "No", "known_ransomware_campaign_use": "Unknown", "note_urls": [ "https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US", "https://nvd.nist.gov/vuln/detail/CVE-2026-6973" ], "notes": "https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2026-6973", "product": "Endpoint Manager Mobile (EPMM)", "required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "short_description": "Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.", "vendor_project": "Ivanti", "vulnerability_name": "Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability" } ], "source_url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "total_matches": 36 } ```