Matching KEV entries to your asset inventory: names, versions, and CPE

What the question assumes, and what the documents cover

This guide draws on three CISA alerts. The first is the PHP alert, first published October 23, 2026 and revised October 26, 2026. The others are the KEV addition notices of October 27, 2026 and October 30, 2026. None of the three mentions CPE strings. They do not define them, show one, or say how to derive one from a KEV entry. This guide therefore does not explain CPE. What follows covers only what the alerts give you to match against an inventory, and where they stop.

What a KEV addition notice gives you

The October 27, 2026 notice opens with its basis for listing. CISA says it added two vulnerabilities to the Known Exploited Vulnerabilities Catalog "based on evidence of active exploitation."

Each entry is one line made of a CVE ID, a vendor and product name, and a vulnerability type. The October 27, 2026 notice lists two:

• CVE-2026-48356 is for Adobe Commerce and Magento, described as an unrestricted upload of file with dangerous type vulnerability.
• CVE-2026-111497 is for Google Brotli, described as an unchecked return value vulnerability.

The October 30, 2026 notice lists two more, both for the same product:

• CVE-2026-111357 is for Ivanti Connect Secure, described as a missing authentication for critical function vulnerability.
• CVE-2026-118527 is for Ivanti Connect Secure, described as a generation of predictable numbers or identifiers vulnerability.

What the notices leave out

Read as written, the two KEV notices carry no version numbers. They carry no build identifiers and no fixed-release information. The vendor and product text is a plain name. The notices do not say which releases of Adobe Commerce, Magento, Brotli or Ivanti Connect Secure are affected, and they do not say which release fixes the problem.

CISA's notices point elsewhere for the rest of the entry's context. They describe a nomination process for the catalog and say what a candidate needs. In CISA's words, "Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance." A catalog entry therefore rests on a CVE ID plus mitigation guidance. The notice text does not reproduce that guidance or any version ranges.

For the Adobe, Google and Ivanti entries, the documents give you a CVE ID and a product name to look for. They give you nothing to decide whether a particular installed version is affected. Do not assume the notices answer that question.

The one alert that does carry version details: PHP

The PHP alert is a longer advisory and contains the version data the KEV notices lack. CISA says the php2shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, "allow for unauthenticated remote code execution in PHP."

On scope, CISA's alert says the flaws affect all PHP installations serving web requests. It names Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The alert does not limit the list to one product name. The affected "product" is the PHP runtime in several deployment forms.

On fixed versions, CISA tells organizations to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. These are the release numbers an inventory check can be compared against. The alert also names a version boundary. Organizations that cannot update, or that still run PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they are patched or updated.

On the KEV date, the alert records that CISA added both CVEs to the catalog on Oct. 26, 2026. The October 26, 2026 update to the alert says the same.

Why name matching alone can miss assets

The PHP alert gives a direct warning about inventory. Its first action is to identify and inventory systems running any version of PHP across the organization. It then explains the difficulty: "PHP is often a component of other software and prevalence may not be directly observable."

The practical meaning, taken from CISA's own words, is that a search for a product called "PHP" may not find every affected system. The component can sit inside other software, and the inventory entry for that software may carry a different name. The documents do not say how to resolve that. They do not describe a software bill of materials, a scanner or any identifier scheme. They state only that the prevalence may not be directly observable.

Where CPE strings fit, based on these documents

They do not appear. CISA's KEV notices identify entries by CVE ID, vendor and product text, and vulnerability type. The PHP alert adds version numbers and deployment forms. If your inventory tooling uses CPE strings, nothing in these three alerts tells you how to translate an entry into one, or how to confirm that a string matches. A team that relies on CPE would need a source outside these documents for that step, and this guide does not supply one.

What the alerts do support is a short sequence of checks:

• Take the CVE ID and the vendor and product text from the notice.
• For PHP, compare installed versions against the fixed releases CISA lists.
• For the other entries, find the affected version information elsewhere, since the notices do not give it.
• Look for the component inside other software, since the PHP alert says it may not be visible directly.

After you have a list: what CISA says to do with it

For PHP, CISA says to apply the patch immediately and prioritize internet-facing systems. It says a web application firewall may provide some protection until systems are updated. It also says to monitor for PHP worker processes launching shells or downloading tools.

The KEV notices add a wider frame. BOD 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities. It also sets expectations for when agencies must check whether threat actors compromised a system before the patch was applied. The directive binds only federal civilian agencies, but CISA encourages all organizations to adopt risk-based vulnerability management.

Summary

A KEV notice gives you a CVE ID, a vendor and product name, and a vulnerability type. Version detail appears only in the PHP alert, with four fixed releases and an unsupported boundary at PHP 8.1 and earlier. CISA warns that PHP can hide inside other software. None of the three documents mentions CPE strings, so their role in this process is not something these sources can confirm.