CISA KEV, the Known Exploited Vulnerabilities catalog, is a public list maintained by the United States Cybersecurity and Infrastructure Security Agency that records vulnerabilities with reliable evidence of active exploitation in the wild. Each entry names a CVE, the affected vendor and product, a required action and a remediation due date.
In the field of vulnerabilities, the catalog answers a question that severity scores cannot: is anyone actually attacking this flaw right now? It is binding for United States federal civilian agencies under Binding Operational Directive 22-01, and it has become a widely used prioritization signal for private organizations worldwide.
How a vulnerability enters the KEV catalog
A vulnerability is added to CISA KEV only when it meets three published criteria. The bar is intentionally conservative, so that every entry represents a real and actionable risk rather than a theoretical one.
| Criterion | Requirement | Reason |
|---|---|---|
| CVE identifier | The flaw has an assigned CVE ID | Unambiguous tracking across tools |
| Active exploitation | Reliable evidence of exploitation attempts in the wild | Separates real attacks from proofs of concept |
| Clear remediation | A patch, mitigation or vendor guidance exists | Entries must be actionable |
Evidence of exploitation can come from incident response work, government partners, vendors or security researchers. A public proof-of-concept exploit alone is not enough; there must be observed attempts against real systems. Successful compromise is not required, because attempted exploitation already shows attacker intent.
What each catalog entry contains
The catalog is published as a web list and as machine-readable CSV and JSON feeds, which makes it easy to join with scanner output, asset inventories and ticketing systems. The main fields are shown below.
| Field | Content | Typical use |
|---|---|---|
| cveID | CVE identifier | Joining with scanner findings |
| vendorProject / product | Affected vendor and product | Mapping to the asset inventory |
| dateAdded | Date of inclusion | Measuring exposure windows |
| requiredAction | Patch, mitigate or discontinue use | Remediation instructions |
| dueDate | Deadline for federal agencies | Internal SLA benchmarks |
| knownRansomwareCampaignUse | Known or Unknown | Raising urgency further |
The ransomware flag is particularly useful for triage: a KEV entry marked as used in ransomware campaigns signals both active exploitation and a high-impact outcome.
Remediation deadlines under BOD 22-01
Binding Operational Directive 22-01, issued in November 2021, requires federal civilian executive branch agencies to remediate KEV entries on their systems by the listed due date. For most newly added vulnerabilities the window is two weeks; older CVEs present in the initial catalog received longer deadlines, and CISA may set shorter ones for urgent cases.
The directive does not legally bind private companies or state and local governments, yet many adopt the same deadlines voluntarily. Frameworks, auditors and cyber insurers increasingly ask whether an organization tracks and remediates KEV entries, which turns the catalog into a de facto industry baseline.
The catalog grows continuously, often by several entries in a single week when a widely deployed product is under attack, and it has held well over a thousand vulnerabilities for years. Entries are rarely removed, so the list functions as a cumulative record of proven attacker interest. Because new additions can appear on any working day, teams usually poll the JSON feed daily or subscribe to update notifications rather than reviewing it once a month.
KEV compared with CVSS and EPSS
CISA KEV complements, rather than replaces, the other common vulnerability signals. Each answers a different prioritization question, and combining them gives a sharper picture than any single metric.
| Signal | Question it answers | Nature | Main limitation |
|---|---|---|---|
| CISA KEV | Is it being exploited now? | Binary, evidence-based | Covers only confirmed cases |
| CVSS | How severe could exploitation be? | Score from 0.0 to 10.0 | Says nothing about attacker activity |
| EPSS | How likely is exploitation soon? | Probability from 0 to 1 | Statistical estimate, not proof |
| Vendor advisory | What does the maker recommend? | Narrative guidance | Varies widely in quality |
A practical pattern treats KEV membership as an override: any KEV entry on an exposed asset goes to the top of the queue regardless of its CVSS score. Remaining findings are then ranked with EPSS and CVSS together with asset criticality.
Using KEV in vulnerability management
Most organizations integrate the catalog into their vulnerability management program by matching it automatically against scan results. Many commercial and open-source scanners already tag findings that appear in KEV.
| Situation | Recommended action | Reason |
|---|---|---|
| KEV entry on an internet-facing system | Patch or isolate within days | Highest likelihood of attack |
| KEV entry on an internal system | Remediate within the KEV due date | Lateral movement risk |
| No patch available yet | Apply listed mitigations or disable the feature | Required action still applies |
| End-of-life product | Discontinue or isolate the product | No fix will ever arrive |
| KEV entry flagged for ransomware | Treat as an emergency change | High impact and high likelihood |
Teams should also check for compromise, not only patch. A KEV entry means attackers were already active, so a system that was exposed before patching may need log review and integrity checks.
Limitations of the catalog
CISA KEV is a strong signal, but absence from the catalog does not mean safety. Several limits deserve attention.
- Detection lag: exploitation often begins before evidence reaches the catalog, especially for zero-day attacks.
- Visibility bias: the catalog reflects what CISA and its partners observe, which leans toward products used by government and large enterprises.
- CVE dependency: flaws without a CVE identifier, including many in niche or custom software, cannot be listed.
- No asset context: the catalog cannot know whether a vulnerable product is exposed or critical in a particular environment.
Put simply
Security teams face thousands of known software flaws, far more than they can fix at once. CISA KEV is a short list of the flaws that criminals are actually using. It works like a police warning that a certain kind of lock is being picked in your neighborhood right now.
If one of your systems appears on that list, fix it first. Other flaws still matter, but the ones on this list are no longer hypothetical.
In practice
A hospital IT team receives a weekly scan report with more than 8,000 open findings, over 600 of them rated critical by CVSS. Patching everything at once is impossible during clinical operations. The team imports the KEV JSON feed into its vulnerability dashboard and finds 14 findings that match KEV entries, three of them on an internet-facing VPN appliance and one marked as used in ransomware campaigns.
The VPN appliance is patched in an emergency maintenance window the same night, and its logs are reviewed for signs of earlier compromise. The remaining KEV matches are scheduled within two weeks, mirroring the federal deadline. The most dangerous exposure is closed in one day, while the broader backlog continues on its normal schedule ranked by EPSS and asset importance.