The CISA KEV catalog: the vulnerabilities already being exploited
Of the tens of thousands of CVEs published each year, the CISA KEV catalog isolates the ones that matter most today: those confirmed to be exploited in real attacks.
What KEV is
The Known Exploited Vulnerabilities (KEV) catalog is maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). It lists CVEs for which there is reliable evidence of active exploitation in the wild – not theoretical risk, but observed use against real targets.
For a vulnerability to be added, CISA requires three things: it has an assigned CVE ID, there is reliable evidence of active exploitation, and there is a clear remediation action (such as a vendor patch or mitigation).
Why it became a standard
In 2021, CISA issued Binding Operational Directive 22-01, requiring U.S. federal civilian agencies to remediate KEV-listed vulnerabilities within set deadlines. Although the directive is binding only on those agencies, the KEV catalog was quickly adopted across the private sector as a practical baseline for "what must be fixed first".
It works because it removes ambiguity. Instead of arguing over CVSS scores, teams can point to an authoritative, evidence-based list and act.
How to use KEV in practice
- Cross-reference your asset inventory against the KEV catalog continuously, not once.
- Escalate any match on an internet-facing or business-critical asset to the top of the queue.
- Track KEV additions – the catalog grows as new exploitation is observed, often weekly.
- Where no patch is available yet, apply CISA’s recommended mitigation or isolate the asset.
KEV, EPSS and CVSS together
KEV answers "is it exploited?", EPSS answers "how likely is it to be?", and CVSS answers "how bad is it?". KEV is the strongest single signal for urgency because it is based on confirmed reality. EPSS complements it by flagging what is likely to be exploited before it reaches KEV.
FAQ
Related questions
How often is the KEV catalog updated?
CISA adds vulnerabilities whenever it confirms active exploitation and a remediation exists – in practice, new entries appear regularly, often several times a week.
Does KEV apply to private companies?
BOD 22-01 is binding only on U.S. federal civilian agencies, but the KEV catalog is public and widely used by private organisations as a prioritisation baseline.
What if a KEV vulnerability has no patch yet?
Apply the mitigation CISA lists, restrict or isolate the affected asset, and monitor for a fix. Being in KEV means exploitation is real, so a compensating control is better than waiting.
Keep reading
More guides
-
CVSS vs EPSS: severity is not the same as risk
CVSS tells you how bad a flaw could be. EPSS tells you how likely it is to be exploited. Using them together is the whole point.
Read guide -
How to prioritise vulnerabilities: a practical playbook
You can’t patch everything. Here’s a repeatable way to decide what to fix first, using exploitation, exposure and severity.
Read guide