Known Exploited Vulnerabilities (KEV)

What Are Known Exploited Vulnerabilities?

Known exploited vulnerabilities are CVEs that have confirmed evidence of active exploitation in the wild. Not theoretical risk, not proof-of-concept code, verified use by real attackers against real systems.

The category exists because severity failed as a prioritisation signal. Scanners produce hundreds of findings per environment and CVSS marks a large share of them critical, which tells a team nothing about where to start. KEV status answers the only question that reliably orders a queue: is anyone actually using this?

The catalog that defines the term in practice is maintained by CISA, and its value comes from what it excludes rather than what it contains.

How the CISA KEV Catalog Works and Who Maintains It

The catalog is maintained by the US Cybersecurity and Infrastructure Security Agency and launched in November 2021 alongside Binding Operational Directive 22-01 with an initial tranche of just under 300 vulnerabilities.

The Three Inclusion Criteria

A vulnerability must have an assigned CVE ID, reliable evidence of active exploitation in the wild, and clear remediation guidance, a patch, update, or defined mitigation. If no fix exists, CISA may specify discontinuing use of the product as the required action. All three conditions must hold.

Where the Evidence Comes From

CISA draws on threat intelligence feeds, ISAC reports, vendor security bulletins, federal agency incident reports, partners including the FBI, NSA, and USCYBERCOM, and vetted researcher disclosures. Confirmation, not suspicion, is the bar.

Cadence and Growth

Entries are added in batches, typically every one to two weeks, and the catalog can move within hours when a zero-day is disclosed under active exploitation. It reached about 1,484 entries by the end of 2025, up from 1,239 a year earlier, 245 additions during 2025, a notably faster rate than the 185 added in 2024.

The Catalog Is Additive

Entries are updated but not removed. The catalog spans vulnerabilities disclosed from the 1990s onward, because old CVEs continue to be exploited wherever they remain unpatched. Checking only recent additions misses most of your exposure.

Access and Integration

The catalog is free and published as JSON, CSV, and a searchable web interface, with the NVD linking KEV status directly on CVE detail pages. Nothing about using it requires a commercial relationship or a government affiliation.

Why KEV Status Changes How Security Teams Should Prioritize CVEs

Vulnerability prioritization built on severity alone produces a queue that does not correspond to risk. KEV status fixes the ordering problem at its root.

It Converts Probability Into Fact

CVSS estimates severity. EPSS estimates exploitation likelihood. KEV confirms exploitation is happening. Used together they form a triad: severity says how bad, EPSS says how likely, KEV says it is already underway. A finding scoring high on all three is not a queue item, it is an incident precursor.

It Cuts the Queue by Orders of Magnitude

Under one percent of CVEs ever reach the catalog. Filtering open findings for KEV status turns an unworkable backlog into a list a small team can clear this week. For organisations with limited remediation capacity, this is the difference between prioritising and pretending to.

It Overrides Severity, Not Supplements It

An open KEV finding should jump the queue regardless of CVSS. A medium-severity vulnerability under confirmed exploitation is a more immediate threat than an unreachable critical nobody has ever weaponised. Treating KEV as a tiebreaker rather than an override wastes the signal.

Ransomware Flags Sharpen It Further

Entries marked as known to be used in ransomware campaigns deserve priority even among KEV items, since these are the CVEs that produce encryption events and extortion demands rather than quiet access. Ransomware operators consistently favour perimeter devices, VPNs, firewalls, remote access gateways.

It Survives Audit Scrutiny

Frameworks like NIST CSF and ISO 27001 expect risk-based prioritisation, and confirmed exploitation is the highest-quality evidence available for that argument. Auditors increasingly ask directly whether any open findings appear in the KEV catalog.

How to Integrate KEV Status Into Your Vulnerability Triage Workflow

Integration should be automatic and should happen before a human sees the finding.

• Correlate at ingestion, match scan results against the KEV JSON feed as findings enter the pipeline, not during review
• Run a one-time sweep of all currently open findings against the full catalog, since it includes CVEs from decades back
• Tier your SLAs by evidence: KEV plus ransomware flag first, KEV alone second, everything else on the standard queue
• Subscribe to catalog additions so a newly listed CVE re-prioritises existing findings automatically
• Track KEV coverage as a board-level metric, the percentage of KEV exposure remediated within your window
• Use vendor KEV presence as a procurement signal; repeated entries indicate a security-engineering gap

FAQ

Is the CISA KEV catalog only for government organizations?

No. BOD 22-01 legally binds federal civilian agencies to remediation deadlines, but the catalog is free, public, and equally applicable anywhere. CISA explicitly recommends all organisations use it, and private-sector teams get the same benefit: a short, evidence-backed list of what attackers are actually exploiting right now.

What share of CVEs ever make the KEV catalog?

Well under one percent. The NVD lists over 200,000 CVEs while the KEV catalog reached roughly 1,484 entries by the end of 2025. The overwhelming majority of disclosed vulnerabilities are never confirmed as exploited, which is exactly why KEV status is such an effective filter for triage.

How does a KEV SLA differ from severity-based SLAs?

Severity-based SLAs trigger on CVSS scores, so they fire constantly on vulnerabilities that are never exploited while treating an exploited medium as routine. A KEV SLA triggers on confirmed exploitation evidence. It fires far less often and every trigger matters, which is what makes a one-day window achievable.