A Small KEV Watcher Script for Three-Day Edge Device Deadlines

CISA added 61 vulnerabilities to its Known Exploited Vulnerabilities catalog between 1 September and 16 October 2026, and 52 of them carried a due date three days after they were added. The latest was Fortinet's CVE-2025-61624 on 16 October, due 19 October. NetScaler alone accounted for four entries, added on three dates, two of them Sundays.

Three days doesn't leave room for someone to notice a CISA email on Monday. This guide shows the numbers, then builds a small watcher that checks the official KEV feed and alerts only on the vendors you actually run.

What's affected

Every number below is computed from CISA's JSON feed, catalog version 2026.10.16, which held 1,748 entries. Method: load the file, keep entries whose dateAdded falls between 2026-09-01 and 2026-10-16, and subtract dateAdded from dueDate.

• 61 entries added in the window. 52 had a three-day window and 9 had fourteen days.
• 47 are marked forensicTriage: "Yes". CISA's schema defines that field as whether the vulnerability "requires forensic triage per BOD 26-04".
• For comparison, the same dates in 2025 saw 35 additions, 33 of them with 21-day windows.

To see how much of that lands on the network edge, we tagged entries by vendor and product: Citrix NetScaler, Fortinet, SonicWall SMA1000, Cisco firewall management, Secure Email Gateway, ISE and Catalyst SD-WAN Manager, MikroTik RouterOS, Zyxel switches, Arista VeloCloud Orchestrator, F5 BIG-IP APM, Check Point, Ivanti Connect Secure and Palo Alto Networks PAN-OS. That gives 24 entries, every one with a three-day due date and 21 flagged for forensic triage. Cisco had 5, Citrix 4, and Fortinet and MikroTik 3 each.

BOD 26-04, issued 10 June 2026, binds only federal civilian agencies. But the due dates are public, attackers read the same catalog, and CISA encourages everyone to prioritize KEV entries. Treat the date as the outside limit.

How to check if you're exposed

You need two lists: what CISA has added, and what you run. The first is a public file. The second is a plain text file of vendor and product strings, lowercase, one per line, written the way CISA spells them in vendorProject and product:

citrix netscaler
fortinet
ivanti connect secure
palo alto networks pan-os

Pull the current feed and see what you'd have matched in the last 45 days:

curl -fsSL https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
jq -r '.vulnerabilities[]
  | select(.dateAdded >= "2026-09-01")
  | [.dateAdded, .dueDate, .forensicTriage, .cveID, .vendorProject, .product] | @tsv' kev.json

If that list contains anything in your vendors file that you learned about late, you need the watcher.

What to do now

1. Save the watcher. It downloads the feed, diffs CVE IDs against the last run and prints only new entries whose vendor and product match your list. It uses jq --rawfile, which reads a file into a string variable.

   #!/usr/bin/env bash
   set -euo pipefail
   FEED="https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
   STATE="${STATE:-$HOME/.kev-watch}"
   VENDORS="${VENDORS:-./vendors.txt}"
   mkdir -p "$STATE"
   touch "$STATE/seen.txt"
   
   curl -fsSL "$FEED" -o "$STATE/kev.json"
   jq -r '.vulnerabilities[].cveID' "$STATE/kev.json" | sort > "$STATE/now.txt"
   comm -13 "$STATE/seen.txt" "$STATE/now.txt" > "$STATE/new.txt"
   
   jq -r --rawfile new "$STATE/new.txt" --rawfile vendors "$VENDORS" '
     ($new | split("\n") | map(select(length > 0))) as $n
     | ($vendors | ascii_downcase | split("\n") | map(select(length > 0))) as $v
     | .vulnerabilities[]
     | select(.cveID as $c | $n | index($c))
     | select((.vendorProject + " " + .product | ascii_downcase) as $p
              | any($v[]; . as $x | $p | contains($x)))
     | [.dateAdded, .dueDate, .forensicTriage, .cveID, .vendorProject, .product]
     | @tsv' "$STATE/kev.json"
   
   cp "$STATE/now.txt" "$STATE/seen.txt"
   

2. Seed it once. The first run treats the whole catalog as new and prints every historical match. Run it, archive the output as your baseline, and from then on it prints only fresh additions.

3. Schedule it and route the output. Every 30 minutes, every day, including weekends:

   */30 * * * * cd /opt/kev-watch && ./kev-watch.sh | ./notify.sh
   

   notify.sh is whatever pages your on-call: a webhook, an email or a ticket. An empty run should send nothing.

4. Write the three-day runbook before you need it. When a match fires: confirm which instances run the product and whether they face the internet; read the vendor advisory linked in the entry's notes field; patch or apply the vendor mitigation; and if forensicTriage is Yes, check for compromise before and after patching using the vendor's own guidance, since a patched device can still hold an implant.

5. Keep the vendor list honest. It's only as good as your inventory. Rebuild it from your CMDB or asset scanner each quarter, and add anything internet-facing that you discover outside it.

6. Subscribe as a backup. CISA offers email updates for catalog additions through its subscription page. Keep them, but don't make them the primary trigger.

Why it matters

Three-day windows and weekend additions mean the old model, where someone reads advisories during business hours and files a ticket, misses the deadline by design. Most of the edge entries in this window were also tagged for forensic triage, which is CISA telling you that patching alone may not be enough.

Automation here is cheap. The feed is a single public JSON file with a published schema. The hard part is knowing exactly which vendors and products you run, and that's worth fixing regardless of KEV.

Try it yourself

Write your vendors file from memory, then compare it against an export from your asset inventory or firewall admin console. Count how many internet-facing products were missing from the version in your head. Run the 45-day query above with the corrected list and see which deadlines you'd have hit.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• CISA KEV JSON schema
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• jq manual