To rank exposed assets with the CISA KEV catalog, match the software and versions on each internet-facing asset to KEV entries, then put matches at the top of the queue. KEV says a flaw has been exploited in the wild. It does not say whether your instance is reachable or important.
What KEV is
CISA describes the catalog as the authoritative source of vulnerabilities that have been exploited in the wild. Each entry lists the CVE, vendor and product, a date added, a due date and a required action. The catalog is available as CSV and JSON. CISA's advice is that organisations should use it as an input to their vulnerability management prioritization framework.
A simple ranking routine
- Take your list of internet-facing assets with product and version.
- Download the KEV data and match on vendor and product.
- For each match, check whether your version is affected, using the vendor advisory.
- Rank matches that are reachable from the internet first.
- Within those, rank by what the asset does and what data it holds.
- Assign owners and dates.
Why exposure matters in the ranking
An exploited flaw on an internet-facing login page is a different problem from the same flaw on a lab server behind two firewalls. KEV answers the question of whether attackers have used it. Your inventory answers whether they can reach it.
What KEV does not cover
- Flaws that are exploited but not yet listed
- Misconfigurations, weak passwords and exposed storage, which are not CVEs
- Libraries inside your own applications that you call or do not call
- Business importance, which only you know
So a clean KEV match is not a clean bill of health.
Combining with other signals
Use KEV next to severity scores and exploit probability estimates, not instead of them. A reasonable order is: known exploited and reachable, then high severity and reachable, then known exploited but not reachable, then everything else. Adjust for the business value of each asset.
Click through it at your own pace, or open it full screen.
Keep it automated
Pull the KEV file on a schedule and diff it against the previous copy so new entries trigger a match against your inventory.
A worked example: you find two hosts running affected versions of the same product. One is a customer login portal on the open internet, the other a staging box on a private network. Both match a KEV entry. Fix the portal first, and schedule the staging box for the same week, since private networks are reachable once someone gets in.
Where Safeguard fits
Safeguard offers reachability analysis for software dependencies, zero-day discovery, and policies and gates to enforce fix deadlines. It does not scan your external infrastructure for exposed hosts.
Quick check
Does a KEV match mean I have been breached?
No. It means attackers have exploited that flaw somewhere. Patch or mitigate, and check logs if the asset was exposed.
Sources
Last reviewed: 19 October 2026.
