7 minute read
The CISA Known Exploited Vulnerabilities (KEV) catalog lists CVEs that attackers have exploited in the wild. Security teams use it to decide which third-party patches go first, but a vulnerability in the code their own engineers write can never appear in it.
Key takeaways
The Known Exploited Vulnerabilities (KEV) catalog is a list of CVEs that CISA, the US Cybersecurity and Infrastructure Security Agency, has confirmed attackers exploit in the wild. CISA adds entries when it confirms new exploitation, and you can download the full catalog for free as CSV or JSON.
CISA adds a vulnerability to KEV when it meets three criteria:
Each entry names the vendor and product, describes the vulnerability in a sentence, and gives the date CISA added it and the action to take. It also says whether CISA knows of ransomware campaigns that use the vulnerability.
KEV records what attackers have already done. EPSS estimates what they are likely to do next, and CVSS rates how bad the vulnerability is in general.
| Signal | Question it answers | When it changes | Limit |
|---|---|---|---|
| CISA KEV | Have attackers already exploited it? | When CISA confirms new exploitation | Lists a CVE only after someone was attacked |
| EPSS | How likely are attackers to try to exploit it in the next 30 days? | Every day | A probability, with no proof of exploitation |
| CVSS base score | How severe is the vulnerability in general? | Rarely, after the CVE is published | Says nothing about whether attackers use it |
CISA created KEV in 2021 with Binding Operational Directive (BOD) 22-01, which gave federal agencies a fixed deadline to patch each KEV entry. An older directive, BOD 19-02, set deadlines for internet-facing systems by CVSS score. BOD 26-04, issued on 10 June 2026, revoked both. It sets each patch deadline from four questions:
A KEV listing still matters, but it is now one input. The first question is about your own assets, so you have to answer it yourself. For more on the change, read vulnerability prioritization after the NVD.
Compare the CVE IDs in your scanner results with the catalog. Most scanners and vulnerability management tools can flag KEV entries for you.
A KEV entry means attackers have exploited the CVE, and a system that faces the internet means they can reach it.
The ransomware field tells you which CVEs criminal groups already use to extort companies.
Attackers can start to use a CVE that is not in KEV tomorrow. EPSS shows which of the rest are most likely to be next.
CVEs go to products and services that other organizations use. A broken access check in your API, a business logic flaw in your checkout, or a trust assumption between two of your services never gets one. Attackers can exploit it and it still has no KEV entry.
For a CVE in a popular product, attackers often hit other companies first, and CISA can list the CVE before an attacker reaches you. A bug in your own code exists only in your systems, so the first company attacked through it is yours.
Engineering teams ship more of their own code every year, and coding agents let them ship it faster. If your team ranks findings by KEV and EPSS, a growing share of the backlog has neither.
Three of CISA's four questions work for your own code, because they ask about the system and the exploit:
Then add two things CISA's questions leave out. Find the root cause, because one fix to a shared pattern can close many findings. And check past decisions, so the team reuses a call it already made on a matching finding.
For the full method, read vulnerability prioritization beyond CVSS.
aisy investigates every ticket to learn how your company works, including findings in your own code that no catalog lists. The next finding arrives with the root cause, the owner, and the fix.
KEV stands for Known Exploited Vulnerabilities. The KEV catalog is a list of CVEs that CISA, the US Cybersecurity and Infrastructure Security Agency, has confirmed attackers exploit in the wild.
CISA adds a vulnerability when it meets three criteria: it has a CVE ID, there is reliable evidence that attackers have exploited it or tried to, and there is clear guidance on how to fix it, such as a vendor update.
No. CISA directives bind US federal civilian agencies, but the catalog is free and public, and CISA recommends that every organization use it to decide which patches go first.
KEV records CVEs that attackers have already exploited. EPSS, published by FIRST, estimates the probability that attackers try to exploit a CVE in the next 30 days. Use KEV for what is happening now and EPSS for what is likely next.
BOD 26-04 is the CISA directive for federal patch deadlines, issued on 10 June 2026. It revoked BOD 22-01 and BOD 19-02, and it sets each deadline from four questions: whether the asset is publicly exposed, whether the CVE is in KEV, whether an attacker can automate every step of the exploit, and whether exploitation gives partial or total control of the system.
No. KEV only lists vulnerabilities with a CVE ID. A bug in code your team writes, such as a broken access check in your API, never gets a CVE, so it never appears in KEV, even when attackers exploit it.
Bring a recurring problem from your security backlog. We’ll look at what your team already knows, what it keeps re-checking, and how to get ahead of it.
Shlomie Liberow · Founder, aisy · shlomie@aisy.ai
