A CVE can be exploited and still be absent from CISA's KEV catalog. CISA adds a vulnerability only when it has an assigned CVE ID, there is reliable evidence of active exploitation in the wild, and there is a clear remediation action. If any of the three is missing, or not yet confirmed, it waits.
The three criteria
CISA's KEV criteria page lists them.
| Criterion | What CISA says |
|---|---|
| 1. Assigned CVE ID | A unique, common identifier from the CVE Program, assigned by a CVE Numbering Authority |
| 2. Reliable evidence of active exploitation | Malicious code was executed against a system without the owner's permission |
| 3. Clear remediation guidance | A vendor update, removal if the product is end of life, or a mitigation or workaround |
All three must hold. That explains several gaps that surprise people.
Common reasons something is missing
- No CVE yet. A flaw that is being attacked but has no CVE record cannot be listed. This can happen early in an incident.
- Evidence not yet reliable. Rumor, a single unverified post or a vendor hint is not the same as reliable evidence. CISA uses the word reliable on purpose.
- Only scanning or research. CISA says scanning, security research of an exploit and a proof of concept are not active exploitation for its purposes.
- No clear fix. If there is no update, workaround or mitigation to point to, the entry waits, though CISA's page frames remediation broadly, including workarounds.
- Timing. Evidence may exist that CISA has not yet reviewed. CISA invites people to report evidence through a nomination form.
Why the catalog is narrow on purpose
KEV is meant to be a short list that organizations can act on immediately, not a record of every attack. FIRST puts the catalog at roughly 0.5 percent of published CVEs. That narrowness is useful, but it means KEV has false negatives. A missing entry is not proof of safety.
What to do when your CVE is not listed
- Check other signals. Look at the current EPSS probability and its percentile, and at the vendor advisory for words like exploited or actively exploited. See how to verify an exploited in the wild claim.
- Check for public exploit code and mature tooling, which raise the chance of attack.
- Check exposure. Is the component present, and can it be reached from outside?
- If you hold credible evidence of exploitation, report it. CISA says organizations or individuals with information about an exploited vulnerability not listed are encouraged to do so.
- Set a re-check date. KEV is updated over time, so a daily or weekly look is cheap.
A rule for your own policy
Write down that KEV listing triggers your fastest response, and that evidence of exploitation from a trusted source with no KEV entry gets the same treatment after a named person confirms it. That avoids a policy that only reacts to one government list. It also keeps the decision auditable, since you can point to who confirmed what and when.
Safeguard's zero day discovery and reachability analysis help when a CVE is exploited but not yet listed, by showing whether your code is affected. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow how a new threat is surfaced and checked against what you run, before any catalog lists it.
Quick check
Does a public proof of concept get a CVE onto KEV?
No. CISA says a public proof of concept is not required for listing, and its availability does not by itself show the CVE has been or will be exploited.
Can I tell CISA about an exploited CVE that is not listed?
Yes. CISA's criteria page links a nomination form for evidence of active exploitation.
Sources
Last reviewed: 19 October 2026.
