An NVD record for a CVE in the CISA Known Exploited Vulnerabilities catalog carries four extra fields: cisaExploitAdd, cisaActionDue, cisaRequiredAction and cisaVulnerabilityName. You can list all such records with the hasKev filter. On 18 October 2026 that returned 1,748 records.
The fields
For CVE-2021-44228, fetched on 18 October 2026, the record contained these keys. The schema types them as a date for the first two and text for the others.
| Field | Type | Read it as |
|---|---|---|
| cisaExploitAdd | date | When the CVE entered the catalog |
| cisaActionDue | date | The due date attached to the catalog entry |
| cisaRequiredAction | text | The catalog's stated action |
| cisaVulnerabilityName | text | A name for the issue |
Two cautions. First, the due date and required action are written for the catalog's audience. Your own risk policy may set a different timeline. Second, the fields' presence is a signal that exploitation was observed, not a statement about your exposure.
The count and what it means
A query for all records returned 409,830 on 18 October 2026, and 391,324 without rejected ones. The hasKev query returned 1,748. That is well under one percent of valid records, so a KEV flag is a strong signal because it is rare.
Because the catalog grows, the number will be higher by the time you read this. Re-run the query for a current figure:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?hasKev&resultsPerPage=1"
Read totalResults from the response.
Putting the flag to work
- List your components with known CVEs.
- For each CVE, check the KEV fields in NVD.
- Put any flagged item at the front of the queue, whatever its CVSS score.
- For flagged items, confirm the affected function is reachable in your code.
- Record the date you acted, next to the catalog's date.
A low scored issue with a KEV entry deserves a look before a higher scored one without any. Read more in prioritise with KEV, EPSS and reachability.
What the flag does not tell you
It does not say your version is affected, or that the vulnerable code runs in your product. It also does not say how, where or by whom the flaw was exploited. For those, read the vendor advisory and test your build.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how an exploitation signal changes the order of the work.
Safeguard combines advisory data with reachability analysis, so a flagged CVE can be checked against your actual call paths. Try a free scan.
Quick check
Does a KEV flag mean I am vulnerable?
No. It means exploitation of the CVE was observed. Check your version and whether the code is reachable.
Is the cisaActionDue date my deadline?
It is the date attached to the catalog entry. Your own policy decides your deadline.
Sources
- NVD CVE API 2.0, hasKev query, 18 October 2026
- NVD CVE API 2.0 record for CVE-2021-44228
- NVD API JSON schema
Last reviewed: 19 October 2026.
