The Known Exploited Vulnerabilities catalog, or KEV, is CISA's list of vulnerabilities that have been exploited in the wild. Each entry names a CVE, a vendor and product, the date it was added and a due date. Use it as one input to prioritization, not as a complete list of risk.
What is in an entry
CISA's catalog page describes each entry as carrying a CVE, the vendor and product, the date added and a due date. The page calls it an authoritative source of vulnerabilities exploited in the wild. When we last reviewed it, the page showed 1,748 entries, a number that grows as CISA adds more.
The page does not publish detailed inclusion criteria. Its stated standard is active exploitation, and it invites people to nominate an exploited vulnerability that is missing.
What CISA tells organizations to do
The page advises treating the catalog as one input to your vulnerability prioritization process, following each entry's required action, applying vendor mitigations, assessing each asset's internet exposure, and meeting the listed due date. If mitigations are not available, it points to applicable CISA guidance, or to stopping use of the product.
KEV versus severity scores
| Signal | Question it answers |
|---|---|
| CVSS | How bad could this be in general? |
| EPSS | How likely is exploitation soon? |
| KEV | Has exploitation already been observed? |
| Reachability | Can my code reach the flawed function? |
A medium severity bug that is on KEV may deserve attention before a critical one that nobody exploits and your code never calls. A KEV entry for software you do not run needs no action. That is why the last row matters.
A beginner routine
- Once a week, open the catalog and sort by date added.
- For each new entry, ask whether you run that vendor product.
- If yes, read the vendor advisory and the required action.
- Record the decision and the date in a simple log.
- If no, note it and move on.
Doing this for a month gives you a real sense of what attackers pick up, such as edge devices and widely deployed server software, and it makes a good story for an interview.
What KEV is not
It is not a list of everything dangerous. A vulnerability can be exploited without being on the list yet. It is also not a patching schedule for your own dependencies, since many entries are about products you install rather than libraries you import. For library level work, pair it with advisory data and reachability.
Our post on CVSS, EPSS and KEV explained covers how teams combine these.
Try it yourself
Open the demo to see how zero day watching surfaces newly exploited issues against what you run.
Click through it at your own pace, or open it full screen.
Quick check
Does KEV cover every exploited vulnerability?
No. It lists those CISA has added. Exploitation can happen before an entry exists.
Should I patch every KEV entry?
Only those that affect software you run. Check exposure first, then follow the vendor action.
Sources
Last reviewed: 19 October 2026.
