You can suppress a finding on the CISA Known Exploited Vulnerabilities catalog, but the bar should be much higher. A listing means exploitation was observed in real conditions. Accept only strong evidence that your build is not affected, give it a short end date, require senior approval, and re-check it often.
What a KEV listing tells you
CISA describes the catalog as its authoritative source of vulnerabilities that have been exploited in the wild, and advises organizations to use it as an input to their vulnerability management prioritization framework. So a listing is a strong signal about the vulnerability in general. It does not say your software is affected. That still depends on whether your build contains and exposes the vulnerable code.
Both statements matter. Do not ignore a listing, and do not assume a listing means you are exposed.
Standard for suppressing a listed finding
| Item | Ordinary finding | KEV listed finding |
|---|---|---|
| Evidence | A sentence and a link | A test or reachability result, reviewed by a second person |
| Approver | Peer | Security lead or equivalent |
| End date | Policy default | Shorter, often 30 days or less |
| Re-check | Monthly | Weekly, and on any related update |
| Compensating control | Optional | Expected where the code might be reachable |
Valid reasons that still work
- Component not present. The package is not in the shipped artifact. Show the artifact contents.
- Vulnerable code not present. The affected module was never built into your product.
- Different platform. The advisory applies to an operating system or configuration you do not use. Quote the affected configuration.
Reasons that need extra care: not reachable by analysis alone, since a static result can miss dynamic loading, and mitigations that rely on a single control.
What to do first
- Read the advisory and the catalog entry. Note the affected product and versions.
- Check your SBOM and the shipped artifact.
- If affected, plan the fix or upgrade now. A suppression is not a plan.
- If not affected, write the reason and keep the evidence.
- Tell the owner and, where your process requires it, the security lead.
Keep a list of listed items you have suppressed
A short register of KEV listed suppressions lets you review them weekly. Include the catalog entry date, the reason, the approver and the end date. See checking your stack against the catalog for a quick method.
Customers and auditors
A buyer who sees a listed vulnerability in your product scan will ask. A concise answer with evidence, ideally in a machine readable statement, shortens the thread.
Where Safeguard fits
Safeguard flags known exploited findings alongside reachability analysis and lets policies and gates treat them differently from ordinary findings. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does a KEV listing mean I am vulnerable?
No. It means the vulnerability was exploited in the wild. You are affected only if your build contains and exposes the vulnerable code.
Is a deferral acceptable for a listed finding?
Only with a mitigation, senior approval and a very short date. Prefer fixing it.
Sources
Last reviewed: 19 October 2026.
