The CISA KEV Catalog, Explained
What the Known Exploited Vulnerabilities catalog is, what its due dates really oblige, and how to use KEV as the sharpest free patching signal available.
Guides are curated reference content: drafted with AI assistance, grounded in this site's own data, and maintained over time — unlike the automated news coverage. Editorial policy
Most vulnerability lists tell you what could be exploited. The KEV catalog is different: it lists only what is being exploited, by CISA’s own determination. That single property makes it the highest-signal free feed in vulnerability management.
What KEV is
The Known Exploited Vulnerabilities catalog is maintained by CISA, the US Cybersecurity and Infrastructure Security Agency. A CVE is added only when three conditions hold: it has a CVE ID, there is reliable evidence of active exploitation in the wild, and there is a clear remediation action — usually a vendor patch or mitigation.
Each entry carries a date added, a required action, and a due date. The catalog is published as machine-readable JSON and updated continuously — typically a handful of new entries per week, with occasional large batches when a campaign is unwound.
What the due dates actually mean
The due dates are a legal obligation only for US federal civilian agencies (under Binding Operational Directive 22-01), which must remediate each entry by its deadline. If you are not a US federal agency, the date binds you to nothing.
Treat it instead as a free prioritisation signal: CISA has looked at the exploitation evidence and decided how urgent remediation is. A short window usually means the exploitation is widespread or trivially repeatable.
Why KEV beats scores for patch ordering
A CVSS base score describes structural severity; KEV describes observed reality. The catalog is small — roughly 1,300–1,700 entries against more than 250,000 CVE IDs ever issued — because the overwhelming majority of vulnerabilities are never exploited at all. Working KEV-first collapses an unmanageable backlog into a short, defensible queue: everything on this list is being used against someone right now.
The catalog has limits worth knowing. It records only what CISA can verify, so exploitation that is not publicly evidenced may never appear; and entries are sometimes added long after exploitation began. KEV membership is proof of fire — absence is not proof of safety.
How to actually use it
- Watch the additions, not the catalog. The full list is mostly history; the new entries are the actionable part. Our KEV changelog shows everything added in the last 30 days, with an RSS feed for automation.
- Cross-reference your inventory. Match KEV entries against what you run; everything that matches goes to the top of the queue regardless of score.
- Track deadlines as urgency hints. Our CVE tracker lists each entry’s due date alongside coverage of the vulnerability.
The one-line version
KEV is the shortest list in security with the highest cost of ignoring it — patch what is on it before you argue about anything else.