A known exploited first filter is a strong starting rule for a team with almost no triage time, but it is not enough alone. It tells you what attackers have been seen using. It does not cover issues that are not yet listed, and it says nothing about whether the code runs in your product.
What the filter is
CISA maintains the Known Exploited Vulnerabilities (KEV) catalog, a list of vulnerabilities that have been exploited in the wild. CISA's guidance page says it strongly recommends all organizations review and monitor the catalog and prioritize remediation of the listed vulnerabilities. Federal civilian agencies are bound by a directive with deadlines. Everyone else is not bound but is encouraged to adopt the same priority.
For a stretched team, that gives a clean first rule: if an open finding is in the catalog, it jumps the queue.
Three steps to apply it
- Match. Compare your open findings against the catalog. Many scanners and platforms do this for you. If yours does not, a short script that compares your findings to the catalog can do it.
- Check presence. Confirm the vulnerable package or component is actually in a deployed build, not just a lockfile for a tool.
- Fix or mitigate. Upgrade, or apply a documented workaround, and note the date.
What the filter misses
| Gap | Why it matters | What to add |
|---|---|---|
| Not yet listed | Exploitation can begin before listing | An exploitation probability signal such as EPSS |
| Listed but not reachable | Fix may not reduce risk | Reachability check |
| Your own code | Catalog covers published CVEs | Code scanning |
| Misconfiguration | Often has no CVE | Configuration review |
EPSS is a useful second signal. FIRST describes it as a model estimating the probability a CVE will be exploited in the next 30 days, with scores from 0 to 1 updated daily. FIRST also states that EPSS is not a complete risk score and does not measure the damage of exploitation or whether it affects your environment. So it orders the queue. It does not close it.
A minimal weekly rule
Here is a rule a very small team can keep.
- Anything in the known exploited catalog and present in production: fix this week.
- Anything with a high EPSS score and reachable code: fix this month.
- Everything else: batch into the quarterly upgrade, with a note.
The thresholds for "high" are yours to choose. FIRST does not set one for you, so pick a cutoff, write it down, and revisit it.
For a deeper comparison of the three common signals, see CVSS vs EPSS vs KEV.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a new advisory gets matched against what you already run.
Safeguard's zero-day discovery and reachability analysis cover the gaps in the table, and the free scan at gold.safeguard.sh/scan gives a quick picture.
Quick check
Does being in the catalog mean my product is vulnerable?
No. It means the vulnerability has been exploited somewhere. Your exposure depends on whether you run the affected component in a reachable way.
Do private companies have to follow the catalog?
CISA says it is not binding on organizations outside the federal civilian agencies, but strongly recommends them to prioritize listed items.
Sources
- CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities
- FIRST, EPSS frequently asked questions
Last reviewed: 19 October 2026.
