What is the CISA KEV catalog?
Updated
The Known Exploited Vulnerabilities (KEV) catalog is a public list, maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), of vulnerabilities for which there is reliable evidence of active exploitation in the wild. A vulnerability on the KEV list is not a theoretical risk — attackers are using it now.
Because it is evidence-based rather than severity-based, KEV is one of the strongest available signals for remediation priority. A medium-severity flaw that appears on KEV is a more urgent problem than a high-severity flaw that no one is known to be exploiting, which is why many programs remediate KEV entries ahead of everything else.
What qualifies a vulnerability for the KEV list
CISA adds a vulnerability to the catalog when three conditions are met: it has an assigned CVE identifier, there is reliable evidence that it is being actively exploited, and there is a clear remediation action such as a vendor patch. The evidentiary bar is deliberately high — the list is meant to be a trustworthy signal of real-world attacker activity, not a catalog of everything that could theoretically be abused.
For U.S. federal civilian agencies, KEV carries a binding operational directive with remediation deadlines. Private organizations are not bound by that directive, but the catalog has become a de-facto industry prioritization input precisely because it reflects confirmed exploitation rather than a predicted or hypothetical one.
KEV, CVSS, and EPSS — three different questions
KEV is most useful read alongside the other common vulnerability signals, because each answers a different question. CVSS asks how bad the flaw would be if exploited. EPSS asks how likely it is to be exploited soon. KEV states, as a matter of observed fact, that it is already being exploited. A mature remediation program combines all three rather than sorting by severity alone.
The practical implication is that a raw count of open vulnerabilities is a poor priority list. Filtering to KEV entries first — then layering EPSS probability and CVSS severity — turns a large, undifferentiated backlog into a short list of the findings an attacker is most likely to reach for.
| Signal | Question it answers | Basis |
|---|---|---|
| CVSS | How severe is it if exploited? | Scored characteristics of the flaw |
| EPSS | How likely is exploitation soon? | Statistical prediction from observed data |
| CISA KEV | Is it being exploited now? | Confirmed evidence of active exploitation |
Frequently asked questions
What is the CISA KEV catalog?
It is a public catalog maintained by CISA listing vulnerabilities with reliable evidence of active exploitation in the wild. Each entry has a CVE, confirmed exploitation, and a remediation action. It is widely used to prioritize patching because it reflects real attacker activity rather than theoretical severity.
Is KEV better than CVSS for prioritization?
They answer different questions, so the best programs use both. CVSS rates how damaging a flaw would be; KEV states whether it is actually being exploited. A KEV-listed vulnerability generally warrants faster action than an unexploited one of the same or higher CVSS score, so KEV is a strong first filter with CVSS and EPSS layered on top.
Are private companies required to remediate KEV vulnerabilities?
The binding remediation directive applies to U.S. federal civilian agencies, not private organizations. But the catalog has become a de-facto industry standard for prioritization because it identifies vulnerabilities under confirmed active exploitation, so most security programs treat KEV entries as top-priority regardless of any legal obligation.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.