How many different requiredAction texts does the KEV feed contain?

In the KEV JSON feed fetched on 19 October 2026, the requiredAction field held 46 distinct strings across 1,748 entries. Six wordings cover 95.5 percent of rows. The other 40 are one-off or near-duplicate texts, so group them with a documented rule before counting.

What the field is

Each KEV entry carries a requiredAction field, a sentence telling affected organizations what to do. CISA's catalog page says organizations should use the catalog as an input to prioritization and, for the entries on the page, points to vendor instructions and the Binding Operational Directive 26-04 guidance. The field is free text, which matters for anyone counting it.

The six common wordings

Computed from release 2026.10.16 (fetched 19 October 2026):

Together that is 1,670 of 1,748 entries. The remaining 78 split across 40 strings, many of them specific to one product, such as an emergency directive reference or a vendor workaround.

Why a naive count overstates variety

Some of the 46 strings differ by a trailing period, a trailing space, or a stray opening quote mark. For example, near-identical sentences about discontinuing use differ only in one using a period and the other not. If you group on the raw string you will report variants that a human reader would call the same.

A simple normalization rule is enough:

1. Trim leading and trailing whitespace and quote marks.
2. Strip a final period.
3. Lowercase.
4. Count distinct values again, and report both numbers.

State the rule in your methodology. A reader can then reproduce your count of distinct strings, rather than wondering why theirs differs.

Grouping by intent instead

For a chart, a few intent classes are more readable than 46 strings. One reasonable set is "apply update", "apply mitigation or discontinue", "end of life, disconnect" and "directive specific". Assign each entry by keyword rules, publish the rules, and spot check a sample by hand. Do not call the result an official CISA category, because it is your classification.

Note that an entry's action describes what CISA asked for at the time it was written. The feed shows one value per entry, so you cannot tell from a single snapshot whether text was edited later. Comparing two dated snapshots can show that; see the corrections log post.

A worked normalization

Take two strings from the feed that a human would call identical: "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable." and the same sentence without the final period. Counted raw, they are two values (13 and 6 entries). After trimming and removing a final period they merge into one value covering 19 entries. The raw distinct count was 46, and normalizing like this lowers it a little further, which is why you should report both.

This is a counting rule, not a judgment about CISA's wording. The entries may have been written at different times by different people, and the feed does not record that.

Building intent classes

Keyword rules are enough for a first pass. For example:

Run the rules in order, so each entry lands in exactly one class, then count the classes and check that they sum to 1,748. Spot check about twenty rows by hand, and write down any rule you changed.

What you can and cannot conclude

You can say how the wording is distributed across the catalog. You cannot say that an entry with the update wording was less serious, or that discontinue-use wording means no patch exists. The text describes the instruction CISA gave, and the reasons are in the vendor advisory linked from the notes. For those links, see what the notes field points to.

Steps to reproduce the table above

1. Load the vulnerabilities array.
2. Count the raw requiredAction strings with a counter.
3. Print the six most common with their counts.
4. Sum those six and divide by the entry count (1,670 of 1,748 is 95.5 percent).
5. Normalize and recount, and report both distinct counts.

import json, collections
rows = json.load(open("kev.json"))["vulnerabilities"]
c = collections.Counter(r["requiredAction"] for r in rows)
print(len(c), sum(n for _, n in c.most_common(6)), len(rows))

The printed numbers should be 46, 1670 and 1748 for the 2026.10.16 release. If you see different numbers, check your release first.

Try it yourself

Click through it at your own pace, or open it full screen. Look at how a finding changes meaning once you know whether it is exploited, which is what the KEV flag adds.

Quick check

Sources

• CISA KEV JSON feed, catalogVersion 2026.10.16, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (fetched 19 October 2026; counts computed by the author).
• CISA, Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog (fetched 19 October 2026).

Last reviewed: 19 October 2026.