Is this CVE patched yet? How to check exploit status and patch availability

Last updated: May 21, 2026

To know whether a CVE is patched and how urgent it is, check three things: the CVE record for severity and vendor fix, the CISA KEV catalog for known active exploitation, and the FIRST EPSS score for the probability it will be exploited. LiveDataLink exposes all three.

Pull the CVE record

Start with the vulnerability detail: CVSS score, affected products, the CWE weakness, and references including any vendor advisory. The cve_lookup tool returns the full CVE record by ID.

{
  "method": "tools/call",
  "params": {
    "name": "cve_lookup",
    "arguments": { "cve_id": "CVE-2024-3094" }
  }
}

Check active exploitation (CISA KEV)

If a CVE is in the CISA Known Exploited Vulnerabilities catalog, it is being exploited in the wild right now, and that overrides almost any other score. Check it with kev_status_check.

{
  "method": "tools/call",
  "params": {
    "name": "kev_status_check",
    "arguments": { "cve_id": "CVE-2024-3094" }
  }
}

Read the exploit probability (EPSS)

FIRST's Exploit Prediction Scoring System estimates the probability a CVE will be exploited in the next 30 days, from 0 to 1. Pull it with epss_score.

{
  "method": "tools/call",
  "params": {
    "name": "epss_score",
    "arguments": { "cve_id": "CVE-2024-3094" }
  }
}

Triage

In CISA KEV: patch now. It is actively exploited.
EPSS above 0.5 and CVSS 9 or higher: treat as critical, patch fast.
EPSS above 0.1 and CVSS 7 or higher: high priority, schedule promptly.
Otherwise: patch in your normal cycle.

"Patched" versus "remediated"

"Patched" means the vendor has shipped a fix. "Remediated" means you have actually deployed that fix (or a mitigation) in your environment. A CVE can be patched by the vendor and still wide open on your systems until you remediate.

FAQ

A high CVSS but low EPSS, do I still need to hurry?

Severity and exploit likelihood are different. A high CVSS with low EPSS and no KEV listing is dangerous if exploited but unlikely to be hit soon, so it can often wait for your normal cycle. Re-check, because EPSS changes daily.

What if there is no patch yet?

Apply vendor mitigations, restrict exposure, and monitor. Re-run kev_status_check and cve_lookup as the situation develops.

Where does this data come from?

The CVE record, the CISA KEV catalog, and FIRST EPSS, surfaced through cve_lookup, kev_status_check, and epss_score.

Last updated: May 21, 2026 · LiveDataLink home