What is the KEV catalog? CISA's Known Exploited Vulnerabilities, defined

The Known Exploited Vulnerabilities (KEV) catalog is the public list, kept by the US Cybersecurity and Infrastructure Security Agency (CISA), of software and hardware flaws that attackers are confirmed to be exploiting. Each entry is a CVE with a required action and a due date, and patch teams use the list to decide which open vulnerabilities to fix first.

What gets a vulnerability onto KEV

CISA applies three tests. The flaw needs a Common Vulnerabilities and Exposures (CVE) identifier, reliable evidence of active exploitation in the wild, and a clear remediation action, such as a vendor update.

The exploitation test is stricter than many teams assume. Scanning, exploit research and a published proof of concept do not count. CISA counts attempted and successful exploitation by an actor working without the system owner's permission.

KEV versus CVE, CVSS and EPSS

The two terms people most often compare are KEV and CVE. CVE is the naming system, with one record per disclosed flaw; KEV is a short filter laid over it. The catalog showed 1,748 entries when fetched for this page on 19 October 2026, while the 2025 CWE Top 25 analysis drew on 39,080 CVE Records from a single year's dataset.

Scores answer different questions. A CVSS score rates how severe a flaw could be, and an EPSS score estimates how likely exploitation is. KEV records that CISA has confirmed it. NIST's National Vulnerability Database shows a KEV section on a CVE's detail page only when that CVE is in the catalog.

Who has to act on it

Federal civilian executive branch agencies must remediate KEV entries within the timeframes of Binding Operational Directive (BOD) 26-04, issued on 10 June 2026. Other organizations are not bound, but CISA strongly recommends that every one of them write immediate KEV remediation into its vulnerability management plan.

What a patch desk does with it

Pull the catalog on a schedule rather than waiting for headlines; CISA publishes it as CSV and JSON. Match each new entry against the asset inventory, then read the fields that set the clock: date added, due date, known ransomware campaign use and, since BOD 26-04, whether forensic triage is required. The federal deadline table is explained in the KEV guide.

Where it appears on Daily CISO

Must-patch lists every KEV addition from the trailing 45 days with its CISA due date and EPSS score. Exploit lag measures how long each of those CVEs was public before CISA listed it. The KEV guide covers the criteria and the BOD 26-04 deadlines in full.

Related terms

Common Vulnerabilities and Exposures (CVE), exploit lag, Exploit Prediction Scoring System (EPSS) and n-day vulnerability.