How to Read a CISA KEV Entry Field by Field, With jq

CISA's Known Exploited Vulnerabilities catalog is a plain JSON file, and each entry packs a lot into a dozen fields. On 14 October 2026 CISA added CVE-2026-0322, a code injection bug in Palo Alto Networks PAN-OS, with a due date of 17 October. This post reads that one entry line by line, so the next one takes you ten seconds.

The numbers come from catalog version 2026.10.16, released 16 October 2026, which held 1,748 entries.

What's affected

The entry describes the vulnerability, not your exposure. The product here is PAN-OS, and the short description says an authenticated attacker with network access could execute arbitrary code with root privileges on the firewall. The entry does not list versions. For those you follow the vendor link in the notes field.

Here is the real entry, trimmed to the fields that matter:

{
  "cveID": "CVE-2026-0322",
  "vendorProject": "Palo Alto Networks",
  "product": "PAN-OS",
  "dateAdded": "2026-10-14",
  "dueDate": "2026-10-17",
  "knownRansomwareCampaignUse": "Unknown",
  "forensicTriage": "Yes",
  "cwes": ["CWE-94"]
}

How to check if you're exposed

Download the feed and pull the entry:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json

jq '.catalogVersion, .count' kev.json
jq '.vulnerabilities[] | select(.cveID == "CVE-2026-0322")' kev.json

Then read the fields in this order:

• dateAdded and dueDate. The clock starts at dateAdded. Here the window is three days.
• forensicTriage. Yes means CISA expects you to check whether the system is already compromised, not just patch it. This field came with BOD 26-04, issued 10 June 2026.
• knownRansomwareCampaignUse. Known or Unknown. Unknown means CISA has no evidence, not that ransomware crews are staying away. Across the whole catalog, 361 of 1,748 entries are marked Known.
• cwes. The weakness class. CWE-94 is code injection.
• notes. Links to the vendor advisory, the BOD 26-04 pages and the NVD record. This is where your fix versions live.
• requiredAction. Boilerplate for most entries, but read it: it tells you to discontinue use if mitigations are unavailable.

To find every PAN-OS entry in one line:

jq -r '.vulnerabilities[] | select(.vendorProject == "Palo Alto Networks") | [.cveID, .dateAdded, .dueDate] | @tsv' kev.json

What to do now

1. Find out whether you run the product. Check your asset inventory for PAN-OS and its management interface exposure.
2. Open the vendor advisory from notes and match your version against the fixed releases.
3. Where forensicTriage is Yes, schedule the compromise check alongside the patch, not after it.
4. Restrict management interface access to trusted internal addresses. The CVE description itself points to this as a risk reducer.
5. Put the due date in your ticket. Three days is short enough that it needs an owner today.

Why it matters

The feed is the cheapest signal in vulnerability management. It is free, machine readable and updated on the days CISA acts, including weekends. Once you can read an entry, you can script a watcher or wire it into a ticket.

One caution: the due dates formally bind US federal civilian agencies. For everyone else they are a public statement that exploitation has been observed, and attackers read the same file.

Try it yourself

Run the first jq command above, then pick any entry from the latest three days and write down its due date, forensic triage flag and CWE. Then try the demo.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA KEV catalog JSON feed, version 2026.10.16
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• NVD record for CVE-2026-0322