Actively exploited means there is evidence that attackers are using a vulnerability against real targets, not just that the flaw exists on paper. It moves an update from "install soon" to "install now". CISA keeps a public catalog of these flaws, called Known Exploited Vulnerabilities, or KEV.
Vulnerable versus exploited
A vulnerability is a weakness. NIST defines it as a weakness in an information system, system security procedures, internal controls or implementation that a threat source could take advantage of. Thousands are published each year, and most are never used in an attack.
An exploited vulnerability is one where someone has actually turned the weakness into an attack. That is rarer and far more urgent.
| Term | Plain meaning | Urgency |
|---|---|---|
| Vulnerability | A weakness exists | Depends on severity and exposure |
| Proof of concept | Someone showed it can be attacked in a lab | Higher |
| Exploited in the wild | Attackers are using it against real targets | Highest |
What the KEV catalog is
CISA describes the KEV catalog as the authoritative source of vulnerabilities that have been exploited in the wild. Each entry lists the CVE, the vendor and product, a description, the weakness type, whether it is known to be used in ransomware campaigns, the date added, a due date and the required action. It is available as CSV and JSON as well as on the web page. The page states no formal inclusion criteria beyond actual exploitation in the wild, and invites nominations.
The due dates and required actions are written for US federal agencies, but anyone can use the list as a signal of what attackers are using now.
What to do when a notice says actively exploited
- Find out whether you use the product named. Check the vendor, product and version.
- Install the fix, or apply the vendor's stated mitigation, as soon as you can.
- If no fix exists, follow the vendor's mitigation advice or stop using the product until one does. The KEV page itself says to apply mitigations in line with vendor instructions or discontinue use where mitigations are unavailable.
- Tell anyone else who uses the same product at home or work.
- If the product was exposed to the internet before you patched, consider checking logs or asking your IT contact to check.
What if the notice does not say
Many notices are silent on exploitation. A silent notice is not proof that nobody is attacking. Check the KEV catalog by CVE number or product name when a notice mentions a serious flaw.
Where Safeguard fits
Safeguard scans your dependencies, matches them against vulnerability data, and uses exploitability and reachability analysis to help you separate flaws your code can actually trigger from background noise. Policies and gates can block known exploited components from shipping. A free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare a finding that is merely present with one that is both reachable and exploitable.
Quick check
Is every flaw in the KEV list a flaw I must fix today?
Only if you run the affected product and version. If you do, treat it as urgent, since attackers are already using it.
Does a flaw missing from KEV mean it is safe?
No. It only means CISA has not listed it. Severity, exposure and your own setup still matter.
Sources
Last reviewed: 19 October 2026.
