# The CISA KEV Catalog, Explained

> What the Known Exploited Vulnerabilities catalog is, what its due dates really oblige, and how to use KEV as the sharpest free patching signal available.

- Published: 2026-08-05T00:00:00.000Z
- Tags: CISA, KEV, Vulnerability Management
- Author: RuntimeRebel Editorial
- Canonical: https://runtimerebel.com/guides/cisa-kev-catalog-explained

Most vulnerability lists tell you what *could* be exploited. The KEV catalog
is different: it lists only what **is being exploited**, by CISA's own
determination. That single property makes it the highest-signal free feed in
vulnerability management.

## What KEV is

The Known Exploited Vulnerabilities catalog is maintained by CISA, the US
Cybersecurity and Infrastructure Security Agency. A CVE is added only when
three conditions hold: it has a CVE ID, there is reliable evidence of active
exploitation in the wild, and there is a clear remediation action — usually a
vendor patch or mitigation.

Each entry carries a **date added**, a **required action**, and a **due
date**. The catalog is published as machine-readable JSON and updated
continuously — typically a handful of new entries per week, with occasional
large batches when a campaign is unwound.

## What the due dates actually mean

The due dates are a legal obligation **only for US federal civilian agencies**
(under Binding Operational Directive 22-01), which must remediate each entry
by its deadline. If you are not a US federal agency, the date binds you to
nothing.

Treat it instead as a free prioritisation signal: CISA has looked at the
exploitation evidence and decided how urgent remediation is. A short window
usually means the exploitation is widespread or trivially repeatable.

## Why KEV beats scores for patch ordering

A [CVSS base score](/guides/how-to-read-a-cvss-score) describes structural
severity; KEV describes observed reality. The catalog is small — roughly
1,300–1,700 entries against more than 250,000 CVE IDs ever issued — because
the overwhelming majority of vulnerabilities are never exploited at all.
Working KEV-first collapses an unmanageable backlog into a short, defensible
queue: *everything on this list is being used against someone right now.*

The catalog has limits worth knowing. It records only what CISA can verify,
so exploitation that is not publicly evidenced may never appear; and entries
are sometimes added long after exploitation began. KEV membership is proof of
fire — absence is not proof of safety.

## How to actually use it

- **Watch the additions, not the catalog.** The full list is mostly history;
  the new entries are the actionable part. Our [KEV changelog](/cve/new)
  shows everything added in the last 30 days, with an [RSS feed](/cve/new.xml)
  for automation.
- **Cross-reference your inventory.** Match KEV entries against what you run;
  everything that matches goes to the top of the queue regardless of score.
- **Track deadlines as urgency hints.** Our [CVE tracker](/cve) lists each
  entry's due date alongside coverage of the vulnerability.

## The one-line version

KEV is the shortest list in security with the highest cost of ignoring it —
patch what is on it before you argue about anything else.

---

Curated evergreen guide, produced with AI assistance and maintained by the site (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/guides/cisa-kev-catalog-explained