Yes, but only when you can support it. Customers use exploitation status to set urgency, so state it plainly and cite the source. CISA's Known Exploited Vulnerabilities catalog is one reference, and CISA says it should be used as an input to your own prioritization, not a replacement for it.
What the KEV catalog is
The Known Exploited Vulnerabilities catalog is a list maintained by CISA of vulnerabilities that have been exploited in the wild. The catalog page describes itself as an authoritative source for that, and each entry shows the CVE, the vendor and product, the date added, a due date, and whether it is known to be used in ransomware campaigns.
The page states that organizations should use the catalog as an input to their vulnerability management prioritization framework. That wording matters for your advisory. It means a KEV listing is a strong signal, not the whole decision.
Three states to distinguish
| State | What you can say | What you should not say |
|---|---|---|
| Listed in KEV | "CISA lists this CVE as known exploited" with a link | That your customers are being attacked, unless you know |
| Exploitation reported elsewhere | Name the source and date | Details you cannot verify |
| No known exploitation | "We are not aware of exploitation as of this date" | "Not exploitable" or "no risk" |
The third row is the one teams get wrong. "Not aware" is a statement about your knowledge on a date. It is not a guarantee, so date it and revisit it.
Steps to handle it in an advisory
- Check the catalog for the CVE before you publish and again before each update.
- If it is listed, say so in the first screen of the advisory, with the link.
- Say whether your product is affected, and which versions.
- If you have seen exploitation against your own customers, state that separately and only to the extent you have confirmed it.
- Add the date of your last check, so readers can judge freshness.
- If the status changes, publish a revision and say what changed. See correcting a published advisory.
Do not turn the catalog into a verdict
An entry also carries action text: apply vendor mitigations, follow the directive guidance, and evaluate each asset's internet exposure. That last point is useful for customers. A flaw that is exploited elsewhere may still be unreachable in a given deployment, and your advisory can help them check.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a new issue is tracked from first signal to a decision about your own exposure.
Quick check
Does a KEV listing mean my customers were attacked?
No. It means the vulnerability has been exploited in the wild somewhere. Whether your customers were hit is a separate question you must answer from your own evidence.
Is "no known exploitation" a safe thing to write?
Only with a date and the wording "we are not aware". It records what you knew, not a promise.
Safeguard's zero-day discovery and reachability analysis help teams see whether a newly exploited flaw touches code they actually run. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
