Yes. Evidence that a vulnerability is exploited in the wild is one of the strongest signals for urgency, so a vendor should shorten its notify, fix and publish clocks when a component flaw appears in a known exploited list. But a missing listing does not prove safety, so use it as one input, not the whole decision.
Definitions
The CISA Known Exploited Vulnerabilities catalog, KEV, is described on CISA's page as an authoritative source of vulnerabilities that have been exploited in the wild. CISA says organisations should use it as an input to their vulnerability management prioritisation framework. Exploit maturity is also a Threat metric in CVSS 4.0, which changes over time and can differ from the Base score.
What changes in your response
| Without exploitation evidence | With exploitation evidence |
|---|---|
| Normal severity based clocks | Shortened clocks for all three stages |
| Direct notice to exposed customers | Direct notice to all customers with affected releases |
| Advisory on fix | Early advisory with a mitigation |
| Routine review | Named lead and a timestamped log |
If your product is in scope of the EU Cyber Resilience Act and you become aware that a flaw in your product is being actively exploited, Article 14 has its own 24 hour, 72 hour and 14 day steps. A listing about a component is not by itself your own awareness about your product, but it is a strong prompt to check right away.
How to add it to triage
- After matching an advisory to your products, check whether the identifier appears in the KEV list.
- Record the result and the date you checked, since listings are added over time.
- If listed, move the issue to your exploited tier and shorten the clocks.
- Ask whether your product exposes the vulnerable path in the way attackers use it.
- Recheck at each update. Do not assume a first check holds.
Limits
- The list only holds what has been reported and confirmed. Exploitation can happen before an entry exists.
- A listing for a component says nothing about whether your product uses the vulnerable code. Reachability analysis or testing answers that.
- Do not copy another organisation's due dates as your own. Those dates belong to their programme, and you should set clocks that match your customers.
Combining signals
A sound triage score uses several inputs: the Base severity, exploitation evidence, whether the code is reachable, product exposure and customer impact. CVSS 4.0 itself says it should be combined with other factors such as regulatory requirements and business impact. A listing raises the weight of exploitation; it does not replace the rest.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how exploit evidence and reachability each change the answer.
Quick check
Is a vulnerability safe if it is not on the list?
No. The list records known exploitation. Absence means not known to the list, not safe.
Do we need to notify customers because a component is listed?
Only if your product is affected. Check that first, then follow your tiers.
Safeguard's reachability analysis and zero-day discovery can help with the affected question. A free scan is available. See also a KEV and EPSS shortlist from your SBOM.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- CVSS v4.0 specification, FIRST
- Regulation (EU) 2024/2847, EUR-Lex, Article 14
Last reviewed: 19 October 2026.
