Home / Knowledge hub / CISA KEV catalogue
Knowledge hub
CISA KEV catalogue
A government list of vulnerabilities known to be exploited in real attacks.
What it means
The Known Exploited Vulnerabilities catalogue, or KEV, is a public list kept by the US Cybersecurity and Infrastructure Security Agency, CISA. Each entry is a vulnerability that has a CVE identifier, has reliable evidence of active exploitation, and has clear guidance on how to fix it. Each entry carries a due date.
The due dates come from a binding directive, BOD 22-01, which obliges US federal civilian agencies to remediate listed flaws by that date. Everyone else is only encouraged to follow it. Even so, the list is useful far beyond government, because it is short and every entry has been seen in real attacks.
Why it matters
Most published vulnerabilities are never used by anyone. KEV is the opposite: the flaws on it have been. That makes it one of the clearest answers to the question of what to patch first. A flaw on the list in software you run deserves attention ahead of a higher CVSS score that nobody is exploiting.
It also gives you a defensible position. When a customer or auditor asks how you prioritise patching, "anything on the CISA list within the stated window" is a simple, public standard. It sits well beside a remediation SLA and a risk-based approach.
How it shows up
Most scanners and asset tools can flag KEV entries automatically. You can also download the catalogue as a CSV or JSON file from CISA and match it against your software inventory. Typical hits are edge devices, file transfer tools, content management systems and widely used libraries.
The gap is that KEV only covers products with CVEs. A broken access check in your own application, or a flaw in a bespoke workflow, will never appear on it, however actively it is abused. Treat it as one input to prioritisation, and test your own code separately.
Questions people ask
CISA KEV catalogue, answered
Who has to follow the KEV catalogue?
US federal civilian executive branch agencies must remediate listed flaws by the due date, under Binding Operational Directive 22-01.
Other organisations are not bound, but CISA encourages all of them to use the list when setting priorities.
How does a vulnerability get added to KEV?
It needs a CVE identifier, reliable evidence of active exploitation, and clear remediation guidance such as a patch or mitigation. CISA assesses each against those criteria.
A flaw that is only theoretically exploitable does not qualify.
Is KEV the same as EPSS?
No. KEV is a list of flaws confirmed as exploited. EPSS is a probability that a flaw will be exploited soon.
KEV is certain but narrow, and EPSS is broader but statistical. Many teams use both.
Does being off the list mean a flaw is safe?
No. The list only holds flaws with evidence CISA has seen. A flaw can be actively used and not yet listed, or be in software without a CVE.
It is a floor for priorities, not a complete picture.
How often is the catalogue updated?
CISA adds entries as it confirms them, often several times in a week, with no fixed schedule.
Subscribe to its alerts or pull the machine-readable file on a schedule rather than checking by hand.
Related
Terms that sit next to this one
EPSS
A score estimating how likely a vulnerability is to be exploited in the next thirty days.
Patch management
The routine of tracking, testing and rolling out updates across your systems.
CVE
A public reference number for one known flaw in one piece of software.
Remediation SLA
The agreed time within which a finding of each severity must be fixed.
Exploit
The specific sequence that turns a suspected weakness into a real one.
Listed, or just not yet seen?
A public list covers other people's software. We find what is wrong in your own application and its APIs, and report only what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.