What Is Known Exploited Vulnerabilities Catalog?
The Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with reliable evidence of exploitation in the wild. It is one of the strongest signals for deciding what to patch first.
Also known as:
How a Vulnerability Gets Added to KEV
CISA adds a vulnerability to the catalog when it meets three criteria.
- It has a CVE ID. The vulnerability is formally identified in the CVE program.
- It is actively exploited. There is reliable evidence of exploitation in the wild.
- It has a clear remediation. There is a defined action to take, such as applying a vendor update.
Who Has to Follow KEV
U.S. federal civilian executive branch agencies are required to remediate KEV vulnerabilities within prescribed timeframes, currently set under Binding Operational Directive 26-04. Other organizations are not bound by the directive, but CISA strongly recommends that everyone monitor the catalog and prioritize the vulnerabilities on it.
Why KEV Matters for Prioritization
Only a small fraction of published vulnerabilities are ever exploited. KEV narrows the list to the ones attackers are known to use, which makes it a useful counterweight to severity scores. A Medium CVSS finding that appears in KEV is often more urgent than a Critical finding that no one is exploiting.
KEV, EPSS and CVSS Together
- CVSS estimates how severe a vulnerability could be.
- EPSS estimates how likely it is to be exploited soon.
- KEV confirms that exploitation is already happening.
Used together with reachability and business context, these signals produce a much shorter and more defensible fix list.
How Nullify Uses Threat Intelligence
Nullify is threat-aware: actively exploited vulnerabilities and zero-days affecting technologies you use move up the backlog, and serious disclosures trigger threat investigations. See how Nullify prioritizes with threat intelligence.
Key Takeaways
- KEV is CISA's list of vulnerabilities with confirmed exploitation in the wild.
- Entries need a CVE ID, evidence of active exploitation and a clear remediation.
- Federal agencies must remediate KEV entries within set timeframes; everyone else should prioritize them.
- Combine KEV with CVSS, EPSS and reachability for a defensible fix order.
Read More About Known Exploited Vulnerabilities Catalog
Program Management
See Nullify in Action
Nullify moves actively exploited vulnerabilities to the top of your backlog.