The KEV catalog, short for Known Exploited Vulnerabilities, is CISA's list of vulnerabilities that are being exploited in the wild. CISA describes it as the authoritative source of such vulnerabilities and says organizations should use it as an input to their vulnerability prioritization.
What an entry tells you
Each KEV entry carries more than a CVE ID. According to the catalog page, entries include:
- the date the vulnerability was added
- a due date
- the required action
- whether it is known to be used in ransomware campaigns
- whether forensic triage is required under BOD 26-04
The due date and required action are written for US federal agencies, but the list itself is useful to anyone.
Why it beats a severity score for urgency
A severity score such as CVSS says how bad a flaw could be. KEV says someone is already using it. That is evidence, and it is the strongest reason to move a fix to the front of the queue.
Prediction models such as EPSS estimate what may happen. KEV records what has happened.
How to use it day to day
- Match the catalog against your inventory. You need to know what you run, which is why an SBOM helps.
- Treat any match as top priority and note the due date.
- Check the ransomware field. A "known" value raises the stakes for exposed systems.
- If you cannot patch quickly, record the mitigation you applied and the date you will revisit it.
Subscribe to updates so new additions reach you the same day. Our own coverage of the catalog is at the CISA KEV catalog.
What KEV does not cover
KEV lists exploited flaws that meet CISA's criteria. It is not a complete list of every exploited vulnerability, and a flaw absent from it can still be dangerous. Treat it as a floor for urgency, not a ceiling.
It also says nothing about your own code or about components that have no CVE. Reachability and asset context still decide how much a given entry matters to you.
Safeguard matches findings against exploitation signals and reachability, and its zero-day discovery covers flaws before they get a CVE. A free scan is at gold.safeguard.sh/scan.
Quick check
Do I need to be a federal agency to use KEV?
No. The catalog is public, and CISA says organizations should use it for prioritization. The due dates are directed at federal agencies.
Is every exploited vulnerability in KEV?
No. It is a curated list, so absence is not proof of safety.
Sources
Last reviewed: 19 October 2026.
