What is the CISA KEV Catalog?

The CISA Known Exploited Vulnerabilities (KEV) Catalog is a living list of CVEs for which reliable evidence of active exploitation exists. It does not answer how dangerous a flaw might be in theory; it records that attackers demonstrably use it.

When is a vulnerability included?

1. The vulnerability has a CVE ID.
2. Reliable evidence of active exploitation exists.
3. A clear remediation such as a vendor update is available, or use of the product must stop.

Entries contain vendor, product, description, date added, required action and a deadline for affected US federal agencies. The ransomware campaign field adds useful context but is unknown for many entries.

Example automated comparison

kev = download_json("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json")
installed_cves = scanner.findings()

for finding in installed_cves:
    if finding.cve in kev.vulnerabilities:
        create_priority_ticket(
            cve=finding.cve,
            asset=finding.asset,
            reason="Known exploitation",
            action=kev[finding.cve].requiredAction
        )

This comparison requires a reliable asset and software inventory. A feed without mapping to installed versions creates noise or misses assets the scanner never saw.

How urgent is a KEV match?

Validate it immediately. Internet exposure, attack paths, vendor guidance and signs of prior compromise determine the response. Patching alone may be insufficient after possible exploitation: investigate logs, accounts, persistence and relevant indicators. BOD 22-01 deadlines bind certain US federal agencies, not every organization, but the catalog remains a strong public prioritization input. Absence never proves that a vulnerability is safe or unexploited.

KEV, EPSS and CVSS compared