Teams use CISA's Known Exploited Vulnerabilities catalog to decide which flaws to fix first. The Known Exploited Vulnerabilities catalog lists CVEs observed exploited in the wild and serves as prioritization input, according to CISA's catalog guidance. The catalog gives security and IT teams a short, evidence-based fix list. It cuts through high-severity noise and points work toward flaws attackers already use.
Table of Contents
- What each catalog entry tells you
- Why federal deadlines matter to all teams
- How additions and risk timing work
- What KEV does not cover
- How to use KEV in daily patching
What each catalog entry tells you
Each entry names the CVE, vendor and product, vulnerability name, short description, and required action. It also shows date added, due date, advisory notes, CWEs, and ransomware-campaign use.
That structure lets teams triage fast without reading every advisory. Owners can assign the fix, track the deadline, and check related weaknesses in one place.
Why federal deadlines matter to all teams
Binding Operational Directive 22-01 made the catalog a living list of CVEs with significant risk to the federal enterprise, according to CISA's directive page. Federal Civilian Executive Branch agencies had to remediate each entry by its due date.
Private teams can borrow the same urgency for internet-facing systems. Federal dates signal real-world risk, even where they do not create a legal duty.
How additions and risk timing work
CISA adds a flaw only on evidence of active exploitation. On Oct. 20, 2026, it added six flaws, including Plex Media Server SSRF CVE-2026-96652, and set federal remediation dates, according to CISA's Oct.
20 alert. Timing rules have shifted from flat clocks to risk-based schedules. Older federal practice used longer windows for pre-2021 CVEs and short windows for newer CVEs, while newer policy uses a graduated risk model.
What KEV does not cover
KEV is not a list of every severe flaw. A CVE enters only with reliable exploitation evidence plus an available vendor fix or mitigation.
A public proof of concept alone does not qualify. Ransomware status marked Unknown means use is unconfirmed, not that the flaw is safe.
How to use KEV in daily patching
Feed the CSV or JSON catalog and email alerts into scanners and ticketing. Flag KEV matches automatically and push internet-facing KEV items to the front of the queue, rather than ranking by CVSS severity alone, as described in this KEV workflow explainer.
A practical routine looks like this: Keep non-KEV severe flaws on a normal cycle. Recheck exposure when new KEV entries arrive.
- ingest KEV feed daily into asset inventory and scanner results
- auto-open high-priority tickets for KEV matches
- patch exposed and high-value systems first
- verify fixes, then close tickets with evidence
You Might Also Like
- Cybersecurity Patch Management: Prioritizing Known Exploited Vulnerabilities
- Cybersecurity — KEV Catalog Prevention Guide: Controls, Monitoring, and Recovery
- Cybersecurity — State Sponsored Hack Risk Guide: Data Exposed, Fraud, and Identity Theft