{ "openapi": "3.0.3", "info": { "title": "US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar", "version": "3.0.0", "description": "Audits IT vendors and software stacks against the official U.S. CISA Known Exploited Vulnerabilities (KEV) Catalog (Zero-Key). Flags active ransomware campaigns, BOD 22-01/26-04 patch deadlines, CWEs, and Threat Severity Scores (0-100).\n\n### Enterprise B2B Value Proposition (US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar)\n- **Target B2B Buyers:** CISOs, Vulnerability Management Platforms, MSSPs, and Cyber Insurance Underwriters.\n- **Zero External API Keys Required:** Connects directly to authoritative government, regulatory, and financial primary registries with built-in retry/backoff and deterministic schema normalization.\n- **Quantitative Scoring & RAG Briefs:** Every record is enriched with a quantitative 0-100 risk/viability score and an LLM-ready Markdown executive brief (`CISA KEV Exploited CVE & Ransomware Audited`).\n- **Backend Proxy Secret Injection:** RapidAPI Studio and Zyla API Hub inject `Authorization: Bearer ` invisibly at the proxy layer when forwarding synchronous calls to `https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items`.\n- **Marketplace Categories:** RapidAPI `Cybersecurity` | Zyla API Hub `Security`.\n- **Subscription Tiers (USD):** `BASIC` ($0.00/mo, 15 req/mo hard cap), `PRO` ($19.00/mo, 1,000 req/mo + $0.02/extra), `ULTRA` ($49.00/mo, 5,000 req/mo + $0.015/extra), `MEGA` ($149.00/mo, 25,000 req/mo + $0.010/extra).\n- **SEO Keywords:** cisa-kev, cve-vulnerability, ransomware-audit, patch-management, bod-22-01, secops-threat-intel, exploit-catalog.", "termsOfService": "https://jesleytassili-glitch.github.io/b2b-quant-mcp-n8n-suite/", "contact": { "name": "B2B Quant APIs (@b2b-quant-apis)", "email": "jesleytassili@gmail.com", "url": "https://apify.com/b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor" }, "license": { "name": "Commercial B2B API Subscription (RapidAPI & Zyla Hub)", "url": "https://apify.com/b2b-quant-apis/cisa-kev-ransomware-vulnerability-auditor" }, "x-category": "Cybersecurity", "x-rapidapi-category": "Cybersecurity", "x-zyla-category": "Security", "x-seo-tags": [ "cisa-kev", "cve-vulnerability", "ransomware-audit", "patch-management", "bod-22-01", "secops-threat-intel", "exploit-catalog" ], "x-payout-destination": "Wise #890361113", "x-pricing-plans": { "BASIC": { "tier": "BASIC", "label": "Freemium Developer Trial", "monthlyPriceUsd": 0.0, "monthlyQuotaRequests": 15, "overagePricePerRequestUsd": 0.0, "hardLimit": true }, "PRO": { "tier": "PRO", "label": "Startup & RevOps Pipeline", "monthlyPriceUsd": 19.0, "monthlyQuotaRequests": 1000, "overagePricePerRequestUsd": 0.02, "hardLimit": false }, "ULTRA": { "tier": "ULTRA", "label": "Mid-Market Automation Cluster", "monthlyPriceUsd": 49.0, "monthlyQuotaRequests": 5000, "overagePricePerRequestUsd": 0.015, "hardLimit": false }, "MEGA": { "tier": "MEGA", "label": "Enterprise High-Throughput SLA", "monthlyPriceUsd": 149.0, "monthlyQuotaRequests": 25000, "overagePricePerRequestUsd": 0.01, "hardLimit": false } }, "x-code-snippets": { "cURL": "# Primary Synchronous Endpoint: https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\ncurl --request POST \\\n --url \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\" \\\n --header \"Content-Type: application/json\" \\\n --header \"X-RapidAPI-Host: cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\" \\\n --header \"X-RapidAPI-Key: \" \\\n --data '{\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10}'", "Python": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nurl = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\"\npayload = {\n \"vendorKeyword\": \"Microsoft\",\n \"onlyRansomware\": false,\n \"maxResults\": 10\n}\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\",\n}\n\nwith httpx.Client(timeout=30.0) as client:\n response = client.post(url, json=payload, headers=headers)\n response.raise_for_status()\n print(response.json())\n", "Node.js": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nconst url = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\";\nconst options = {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\"\n },\n body: JSON.stringify({\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10})\n};\n\nconst response = await fetch(url, options);\nconst data = await response.json();\nconsole.log(data);\n" }, "x-primary-backend-url": "https://api.apify.com", "x-primary-backend-base-url": "https://api.apify.com", "x-apify-sync-endpoint": "https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items", "x-apify-health-endpoint": "https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor", "x-backend-secret-header": { "name": "Authorization", "valueTemplate": "Bearer ", "headerName": "Authorization", "headerValueTemplate": "Bearer ", "injectedByProxy": true, "hiddenFromSubscriber": true, "description": "Secret Header injected invisibly by RapidAPI Studio and Zyla API Hub proxy when calling https://api.apify.com." }, "x-openapi-spec-url": "https://jesleytassili-glitch.github.io/specs_openapi_31/cisa-kev-ransomware-vulnerability-auditor.json", "x-openapi-suite-spec-url": "https://jesleytassili-glitch.github.io/b2b-quant-mcp-n8n-suite/specs_openapi_31/cisa-kev-ransomware-vulnerability-auditor.json", "x-apis-json-url": "https://jesleytassili-glitch.github.io/apis.json", "x-github-release-tag": "v2.2.0" }, "externalDocs": { "description": "Official B2B Documentation & Schema Reference for US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar", "url": "https://jesleytassili-glitch.github.io/b2b-quant-mcp-n8n-suite/actors/cisa-kev-ransomware-vulnerability-auditor.html" }, "servers": [ { "url": "https://api.apify.com", "description": "Primary Apify Cloud Synchronous Execution Cluster (Real HTTP 200/201 POST & GET)" }, { "url": "https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items", "description": "Direct Apify Actor Synchronous Execution Endpoint (cisa-kev-ransomware-vulnerability-auditor)" }, { "url": "https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev", "description": "Anti-Bypass Stateless B2B Gateway (RapidAPI & Zyla Hub Proxy)" } ], "tags": [ { "name": "Cybersecurity", "description": "RapidAPI Hub primary category: Cybersecurity (Zyla Hub: Security)" }, { "name": "cisa-kev", "description": "B2B SEO Search Tag: cisa-kev" }, { "name": "cve-vulnerability", "description": "B2B SEO Search Tag: cve-vulnerability" }, { "name": "ransomware-audit", "description": "B2B SEO Search Tag: ransomware-audit" }, { "name": "patch-management", "description": "B2B SEO Search Tag: patch-management" }, { "name": "bod-22-01", "description": "B2B SEO Search Tag: bod-22-01" }, { "name": "secops-threat-intel", "description": "B2B SEO Search Tag: secops-threat-intel" }, { "name": "exploit-catalog", "description": "B2B SEO Search Tag: exploit-catalog" } ], "security": [ { "ApifyCloudBearerAuth": [] }, { "RapidAPIProxySecret": [] }, { "ZylaProxySecret": [] }, { "RapidAPISubscriberKey": [] } ], "paths": { "/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run_sync_cisa_kev_ransomware_vulnerability_auditor", "summary": "Execute US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar (Apify Cloud Synchronous POST)", "description": "Synchronous stateless execution of **US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar**. RapidAPI Studio and Zyla API Hub inject the backend secret header `Authorization: Bearer ` invisibly to the end user, validate `X-RapidAPI-Proxy-Secret` / `X-Zyla-Proxy-Secret` in constant time (`hmac.compare_digest`), inject quota headers (`X-RateLimit-Remaining`, `X-Engine-Version`), and return deterministic JSON records.", "tags": [ "Cybersecurity", "cisa-kev", "cve-vulnerability", "ransomware-audit", "patch-management", "bod-22-01" ], "x-codeSamples": [ { "lang": "cURL", "label": "cURL", "source": "# Primary Synchronous Endpoint: https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\ncurl --request POST \\\n --url \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\" \\\n --header \"Content-Type: application/json\" \\\n --header \"X-RapidAPI-Host: cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\" \\\n --header \"X-RapidAPI-Key: \" \\\n --data '{\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10}'" }, { "lang": "Python", "label": "Python (httpx)", "source": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nurl = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\"\npayload = {\n \"vendorKeyword\": \"Microsoft\",\n \"onlyRansomware\": false,\n \"maxResults\": 10\n}\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\",\n}\n\nwith httpx.Client(timeout=30.0) as client:\n response = client.post(url, json=payload, headers=headers)\n response.raise_for_status()\n print(response.json())\n" }, { "lang": "Node.js", "label": "Node.js (fetch)", "source": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nconst url = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\";\nconst options = {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\"\n },\n body: JSON.stringify({\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10})\n};\n\nconst response = await fetch(url, options);\nconst data = await response.json();\nconsole.log(data);\n" } ], "x-snippets": { "cURL": "# Primary Synchronous Endpoint: https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\ncurl --request POST \\\n --url \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\" \\\n --header \"Content-Type: application/json\" \\\n --header \"X-RapidAPI-Host: cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\" \\\n --header \"X-RapidAPI-Key: \" \\\n --data '{\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10}'", "Python": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nurl = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\"\npayload = {\n \"vendorKeyword\": \"Microsoft\",\n \"onlyRansomware\": false,\n \"maxResults\": 10\n}\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\",\n}\n\nwith httpx.Client(timeout=30.0) as client:\n response = client.post(url, json=payload, headers=headers)\n response.raise_for_status()\n print(response.json())\n", "Node.js": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nconst url = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\";\nconst options = {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\"\n },\n body: JSON.stringify({\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10})\n};\n\nconst response = await fetch(url, options);\nconst data = await response.json();\nconsole.log(data);\n" }, "x-backend-secret-header": { "name": "Authorization", "value": "Bearer ", "visibleToSubscriber": false }, "requestBody": { "required": true, "description": "Structured JSON parameters for `cisa-kev-ransomware-vulnerability-auditor`.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorRequest" }, "example": { "vendorKeyword": "Microsoft", "onlyRansomware": false, "maxResults": 10 } } } }, "responses": { "200": { "description": "Successful synchronous execution of `cisa-kev-ransomware-vulnerability-auditor` returning enriched B2B JSON records.", "headers": { "X-RateLimit-Remaining": { "description": "Remaining requests in the subscriber's monthly plan quota (BASIC=15, PRO=1000, ULTRA=5000, MEGA=25000).", "schema": { "type": "integer", "example": 999 } }, "X-Engine-Version": { "description": "Deterministic B2B engine release version.", "schema": { "type": "string", "example": "3.0.0" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorResponseEnvelope" }, "example": { "status": "succeeded", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "count": 1, "data": [ { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } ] } } } }, "201": { "description": "Synchronous dataset created and returned for `cisa-kev-ransomware-vulnerability-auditor` on Apify Cloud (`HTTP 201`).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorResponseEnvelope" }, "example": { "status": "succeeded", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "count": 1, "data": [ { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } ] } } } }, "400": { "description": "Bad Request — Invalid JSON payload or schema validation error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "error", "code": 400, "message": "Invalid JSON request body." } } } }, "403": { "description": "Forbidden — Missing or invalid `X-RapidAPI-Proxy-Secret` / `X-Zyla-Proxy-Secret` header (Anti-Bypass Protection).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "forbidden", "code": 403, "message": "Direct access denied. Requests must originate from RapidAPI Hub or Zyla API Hub with a valid Proxy-Secret." } } } }, "429": { "description": "Too Many Requests — Monthly plan quota exceeded (e.g., BASIC Freemium 15 req/month hard limit).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "quota_exceeded", "code": 429, "message": "Monthly request quota exceeded for BASIC plan (15 req/month hard limit). Upgrade to PRO ($19/mo), ULTRA ($49/mo), or MEGA ($149/mo)." } } } } } } }, "/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor": { "get": { "operationId": "status_cisa_kev_ransomware_vulnerability_auditor", "summary": "Actor Metadata & Live Connectivity Check for US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar", "description": "Immediate `HTTP 200` status and metadata health check for `cisa-kev-ransomware-vulnerability-auditor` on RapidAPI Studio and Zyla API Hub (`GET https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor` and `GET /v1/cisa-kev-ransomware-vulnerability-auditor/health`) without starting a container build or run.", "tags": [ "Cybersecurity" ], "responses": { "200": { "description": "Engine online and ready (`HTTP 200 JSON`).", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "string", "example": "ok" }, "actor": { "type": "string", "example": "cisa-kev-ransomware-vulnerability-auditor" }, "engineVersion": { "type": "string", "example": "3.0.0" }, "category": { "type": "string", "example": "Cybersecurity" }, "data": { "type": "object", "additionalProperties": true, "example": { "name": "cisa-kev-ransomware-vulnerability-auditor", "username": "b2b-quant-apis", "isPublic": true } } } }, "example": { "status": "ok", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "category": "Cybersecurity", "data": { "name": "cisa-kev-ransomware-vulnerability-auditor", "username": "b2b-quant-apis", "isPublic": true } } } } } } } }, "/v1/cisa-kev-ransomware-vulnerability-auditor": { "post": { "operationId": "execute_cisa_kev_ransomware_vulnerability_auditor", "summary": "Execute US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar", "description": "Synchronous stateless execution of **US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar**. RapidAPI Studio and Zyla API Hub inject the backend secret header `Authorization: Bearer ` invisibly to the end user, validate `X-RapidAPI-Proxy-Secret` / `X-Zyla-Proxy-Secret` in constant time (`hmac.compare_digest`), inject quota headers (`X-RateLimit-Remaining`, `X-Engine-Version`), and return deterministic JSON records.", "tags": [ "Cybersecurity", "cisa-kev", "cve-vulnerability", "ransomware-audit", "patch-management", "bod-22-01" ], "x-codeSamples": [ { "lang": "cURL", "label": "cURL", "source": "# Primary Synchronous Endpoint: https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\ncurl --request POST \\\n --url \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\" \\\n --header \"Content-Type: application/json\" \\\n --header \"X-RapidAPI-Host: cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\" \\\n --header \"X-RapidAPI-Key: \" \\\n --data '{\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10}'" }, { "lang": "Python", "label": "Python (httpx)", "source": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nurl = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\"\npayload = {\n \"vendorKeyword\": \"Microsoft\",\n \"onlyRansomware\": false,\n \"maxResults\": 10\n}\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\",\n}\n\nwith httpx.Client(timeout=30.0) as client:\n response = client.post(url, json=payload, headers=headers)\n response.raise_for_status()\n print(response.json())\n" }, { "lang": "Node.js", "label": "Node.js (fetch)", "source": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nconst url = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\";\nconst options = {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\"\n },\n body: JSON.stringify({\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10})\n};\n\nconst response = await fetch(url, options);\nconst data = await response.json();\nconsole.log(data);\n" } ], "x-snippets": { "cURL": "# Primary Synchronous Endpoint: https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\ncurl --request POST \\\n --url \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\" \\\n --header \"Content-Type: application/json\" \\\n --header \"X-RapidAPI-Host: cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\" \\\n --header \"X-RapidAPI-Key: \" \\\n --data '{\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10}'", "Python": "import httpx\n\n# Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nurl = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\"\npayload = {\n \"vendorKeyword\": \"Microsoft\",\n \"onlyRansomware\": false,\n \"maxResults\": 10\n}\nheaders = {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\",\n}\n\nwith httpx.Client(timeout=30.0) as client:\n response = client.post(url, json=payload, headers=headers)\n response.raise_for_status()\n print(response.json())\n", "Node.js": "// Primary Synchronous Endpoint (Gateway Route: https://b2b-quant-rapidapi-gateway.jesleytassili.workers.dev/v1/cisa-kev-ransomware-vulnerability-auditor)\nconst url = \"https://cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor/run-sync-get-dataset-items\";\nconst options = {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-RapidAPI-Host\": \"cisa-kev-ransomware-vulnerability-auditor.p.rapidapi.com\",\n \"X-RapidAPI-Key\": \"\"\n },\n body: JSON.stringify({\"vendorKeyword\": \"Microsoft\", \"onlyRansomware\": false, \"maxResults\": 10})\n};\n\nconst response = await fetch(url, options);\nconst data = await response.json();\nconsole.log(data);\n" }, "x-backend-secret-header": { "name": "Authorization", "value": "Bearer ", "visibleToSubscriber": false }, "requestBody": { "required": true, "description": "Structured JSON parameters for `cisa-kev-ransomware-vulnerability-auditor`.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorRequest" }, "example": { "vendorKeyword": "Microsoft", "onlyRansomware": false, "maxResults": 10 } } } }, "responses": { "200": { "description": "Successful synchronous execution of `cisa-kev-ransomware-vulnerability-auditor` returning enriched B2B JSON records.", "headers": { "X-RateLimit-Remaining": { "description": "Remaining requests in the subscriber's monthly plan quota (BASIC=15, PRO=1000, ULTRA=5000, MEGA=25000).", "schema": { "type": "integer", "example": 999 } }, "X-Engine-Version": { "description": "Deterministic B2B engine release version.", "schema": { "type": "string", "example": "3.0.0" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorResponseEnvelope" }, "example": { "status": "succeeded", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "count": 1, "data": [ { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } ] } } } }, "201": { "description": "Synchronous dataset created and returned for `cisa-kev-ransomware-vulnerability-auditor` on Apify Cloud (`HTTP 201`).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorResponseEnvelope" }, "example": { "status": "succeeded", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "count": 1, "data": [ { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } ] } } } }, "400": { "description": "Bad Request — Invalid JSON payload or schema validation error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "error", "code": 400, "message": "Invalid JSON request body." } } } }, "403": { "description": "Forbidden — Missing or invalid `X-RapidAPI-Proxy-Secret` / `X-Zyla-Proxy-Secret` header (Anti-Bypass Protection).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "forbidden", "code": 403, "message": "Direct access denied. Requests must originate from RapidAPI Hub or Zyla API Hub with a valid Proxy-Secret." } } } }, "429": { "description": "Too Many Requests — Monthly plan quota exceeded (e.g., BASIC Freemium 15 req/month hard limit).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "status": "quota_exceeded", "code": 429, "message": "Monthly request quota exceeded for BASIC plan (15 req/month hard limit). Upgrade to PRO ($19/mo), ULTRA ($49/mo), or MEGA ($149/mo)." } } } } } } }, "/v1/cisa-kev-ransomware-vulnerability-auditor/health": { "get": { "operationId": "health_cisa_kev_ransomware_vulnerability_auditor", "summary": "Health & SLA Check for US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar", "description": "Immediate `HTTP 200` status and metadata health check for `cisa-kev-ransomware-vulnerability-auditor` on RapidAPI Studio and Zyla API Hub (`GET https://api.apify.com/v2/acts/b2b-quant-apis~cisa-kev-ransomware-vulnerability-auditor` and `GET /v1/cisa-kev-ransomware-vulnerability-auditor/health`) without starting a container build or run.", "tags": [ "Cybersecurity" ], "responses": { "200": { "description": "Engine online and ready (`HTTP 200 JSON`).", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "string", "example": "ok" }, "actor": { "type": "string", "example": "cisa-kev-ransomware-vulnerability-auditor" }, "engineVersion": { "type": "string", "example": "3.0.0" }, "category": { "type": "string", "example": "Cybersecurity" }, "data": { "type": "object", "additionalProperties": true, "example": { "name": "cisa-kev-ransomware-vulnerability-auditor", "username": "b2b-quant-apis", "isPublic": true } } } }, "example": { "status": "ok", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "category": "Cybersecurity", "data": { "name": "cisa-kev-ransomware-vulnerability-auditor", "username": "b2b-quant-apis", "isPublic": true } } } } } } } } }, "components": { "securitySchemes": { "ApifyCloudBearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "APIFY_API_TOKEN", "description": "Backend Secret Header (`Authorization: Bearer `) injected invisibly by RapidAPI Studio and Zyla API Hub proxy when calling https://api.apify.com." }, "RapidAPIProxySecret": { "type": "apiKey", "in": "header", "name": "X-RapidAPI-Proxy-Secret", "description": "RapidAPI Hub shared proxy secret verified in constant time via hmac.compare_digest." }, "ZylaProxySecret": { "type": "apiKey", "in": "header", "name": "X-Zyla-Proxy-Secret", "description": "Zyla API Hub shared proxy secret verified in constant time via hmac.compare_digest." }, "RapidAPISubscriberKey": { "type": "apiKey", "in": "header", "name": "X-RapidAPI-Key", "description": "Subscriber API Key injected by RapidAPI Hub or Zyla API Hub." } }, "schemas": { "CisaKevRansomwareVulnerabilityAuditorRequest": { "type": "object", "title": "US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar Request Schema", "description": "Configure vendor/product keyword filter, optional ransomware-only filter, and maximum CVE vulnerabilities to extract and score.", "properties": { "vendorKeyword": { "type": "string", "title": "Vendor / Product Keyword Filter", "description": "Vendor or software product keyword (e.g., 'Microsoft', 'Cisco', 'Fortinet', 'Linux', 'VMware', or leave empty for latest KEV additions).", "default": "Microsoft", "example": "Microsoft" }, "onlyRansomware": { "type": "boolean", "title": "Only Known Ransomware Campaigns", "description": "If true, filters strictly for CVEs with confirmed ransomware campaign exploitation ('Known').", "default": false, "example": false }, "maxResults": { "type": "integer", "title": "Maximum CVEs to Extract", "description": "Maximum number of exploited CVE records to extract and score (1 to 100).", "default": 15, "minimum": 1, "maximum": 100, "example": 10 } }, "required": [ "vendorKeyword" ], "example": { "vendorKeyword": "Microsoft", "onlyRansomware": false, "maxResults": 10 } }, "CisaKevRansomwareVulnerabilityAuditorRecord": { "type": "object", "title": "US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar Output Record", "description": "Enriched B2B dataset item returned by `cisa-kev-ransomware-vulnerability-auditor`.", "properties": { "cveId": { "type": "string", "title": "CVE Identifier", "description": "Official CVE vulnerability ID.", "example": "CVE-2026-96951" }, "vendorProject": { "type": "string", "title": "Vendor / Project", "description": "Hardware or software vendor.", "example": "Microsoft" }, "product": { "type": "string", "title": "Affected Product", "description": "Specific product or appliance.", "example": "Windows" }, "vulnerabilityName": { "type": "string", "title": "Vulnerability Title", "description": "Official CISA vulnerability title.", "example": "Microsoft Windows Command Injection Vulnerability" }, "dateAdded": { "type": "string", "title": "Date Added to CISA KEV", "description": "Date added to the Known Exploited Vulnerabilities catalog.", "example": "2026-10-13" }, "dueDate": { "type": "string", "title": "Federal Patch Deadline", "description": "Mandatory remediation deadline under CISA BOD directives.", "example": "2026-10-16" }, "knownRansomwareCampaignUse": { "type": "string", "title": "Ransomware Campaign Use", "description": "Known or Unknown active ransomware exploitation.", "example": "Unknown" }, "cwes": { "type": "string", "title": "CWE Weakness Classes", "description": "Associated Common Weakness Enumeration codes.", "example": "CWE-77" }, "threatSeverityScore": { "type": "integer", "title": "Threat Severity Score (0-100)", "description": "Quantitative urgency score combining active exploitation, ransomware use, and RCE/SQLi class (0-100).", "example": 82 }, "requiredAction": { "type": "string", "title": "Mandatory Remediation Action", "description": "CISA-mandated mitigation or patching directive.", "example": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." }, "markdownThreatBrief": { "type": "string", "title": "Markdown DevSecOps & SOC2 Threat Brief", "description": "Executive Markdown advisory for MSSPs, CISOs, and automated patch pipelines.", "example": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } }, "example": { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } }, "CisaKevRansomwareVulnerabilityAuditorResponseEnvelope": { "type": "object", "title": "US CISA KEV Exploited Vulnerabilities & Ransomware Threat Radar Synchronous Response Envelope", "required": [ "status", "actor", "count", "data" ], "properties": { "status": { "type": "string", "example": "succeeded" }, "actor": { "type": "string", "example": "cisa-kev-ransomware-vulnerability-auditor" }, "marketplace": { "type": "string", "example": "rapidapi_zyla_hub" }, "engineVersion": { "type": "string", "example": "3.0.0" }, "count": { "type": "integer", "example": 1 }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/CisaKevRansomwareVulnerabilityAuditorRecord" } } }, "example": { "status": "succeeded", "actor": "cisa-kev-ransomware-vulnerability-auditor", "engineVersion": "3.0.0", "count": 1, "data": [ { "cveId": "CVE-2026-96951", "vendorProject": "Microsoft", "product": "Windows", "vulnerabilityName": "Microsoft Windows Command Injection Vulnerability", "dateAdded": "2026-10-13", "dueDate": "2026-10-16", "knownRansomwareCampaignUse": "Unknown", "cwes": "CWE-77", "threatSeverityScore": 82, "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "markdownThreatBrief": "# US CISA KEV ACTIVE EXPLOITATION & RANSOMWARE ADVISORY: CVE-2026-96951\n\n## 1. Vulnerability & Affected Asset Identity\n- **CVE Identifier:** `CVE-2026-96951`\n- **Vendor / Project:** **Microsoft**\n- **Affected Product:** `Windows`\n- **Vulnerability Name:** Microsoft Windows Command Injection Vulnerability\n- **CWE Weakness Classes:** `CWE-77`\n\n## 2. Ransomware Intelligence & Federal BOD Remediation\n- **Threat Severity Score:** **82/100**\n- **Active Ransomware Campaign Use:** **`Unknown`**\n- **Date Added to CISA KEV:** `2026-10-13`\n- **Mandatory Remediation Deadline:** `2026-10-16`\n- **Required Action:** Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud servic..." } ] } }, "ErrorResponse": { "type": "object", "required": [ "status", "code", "message" ], "properties": { "status": { "type": "string", "example": "error" }, "code": { "type": "integer", "example": 403 }, "message": { "type": "string", "example": "Direct access denied." } } } } } }