What is Known Exploited Vulnerabilities (KEV)?
Known Exploited Vulnerabilities (KEV) is a catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) that lists CVEs confirmed to have been actively exploited in the wild. It is used by security teams to prioritize patching and remediation based on real-world attacker behavior.
What it is
The KEV catalog is a public list published and updated by CISA. Each entry is a CVE that CISA has confirmed is being actively exploited by attackers, not just theoretically possible to exploit. As of 2024, the catalog contains over 1,000 entries spanning operating systems, network devices, browsers, and enterprise software.
Each KEV entry includes:
- The CVE identifier
- The affected vendor and product
- A short description of the vulnerability type
- The required remediation action
- A due date by which U.S. federal civilian agencies must remediate
The due dates apply directly to Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive 22-01, but the catalog is freely available to any organization.
Why it matters
Most organizations have far more vulnerabilities than they can patch quickly. CVSS scores alone do not tell you whether a vulnerability is being used in real attacks right now. A CVE with a CVSS score of 6.5 that appears in the KEV catalog is a higher practical priority than a CVSS 9.8 that has no known exploit in the wild.
Security teams use the KEV catalog to:
- Cut through scanner noise and focus on vulnerabilities attackers are actually using
- Set defensible patch deadlines for asset owners
- Report remediation progress to leadership and auditors
- Align with frameworks such as NIST CSF and CISA guidance
How tools address it
Vulnerability assessment platforms and threat and vulnerability management tools can ingest the KEV catalog as a data source. When a scanner finds a CVE on a scanned asset, the tool checks whether that CVE appears in KEV and raises its priority accordingly. Tools such as unified vulnerability management platforms deduplicate findings across scanners and surface KEV status as a first-class risk signal. Threat intel feeds and threat intel platforms also distribute KEV data alongside other exploit intelligence to help teams correlate findings.