CISA Known Exploited Vulnerabilities Catalog (CISA KEV)

The CISA Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities that are confirmed to have been actively exploited in the wild. Unlike a generic vulnerability database, every entry in KEV represents a documented case of real attackers using that specific flaw against real targets, not a theoretical risk based on how a vulnerability could be exploited.

KEV exists because vulnerability severity, as measured by CVSS, does not correlate well with the likelihood that a given flaw will actually be used in an attack. Thousands of vulnerabilities are published every year with high CVSS scores that are never meaningfully exploited, while some moderate-severity flaws become the basis of widespread campaigns because they are easy to reach and reliably weaponizable. KEV cuts through that gap by tracking observed exploitation rather than theoretical impact.

For US federal civilian agencies, KEV carries binding operational requirements: agencies must remediate KEV-listed vulnerabilities within mandated timeframes, typically far shorter than general patch cycles. Outside government, KEV has become a de facto industry standard for prioritization because it gives security teams an evidence-based signal that a vulnerability is not just possible to exploit but is actually being exploited right now, somewhere.

In an exposure management program, matching externally observed software versions against the KEV catalog is one of the highest-value prioritization signals available. A finding that shows up in KEV should generally be treated as urgent regardless of its raw CVSS score, because it means the finding is not a hypothetical weakness but an active target for opportunistic and targeted attackers alike. Combining KEV status with EPSS exploitation probability and simple business context, such as whether the affected asset is internet-facing, gives a prioritization model that is dramatically more useful than sorting purely by CVSS.

KEV is updated on a rolling basis as CISA confirms new instances of exploitation, so a finding that was low priority last month can become urgent overnight if it is added to the catalog. This is one of the main reasons exposure management needs to be continuous rather than periodic: a vulnerability that was safe to deprioritize during last quarter's assessment may already be under active attack today.