CISA KEV: Known Exploited Vulnerabilities Guide

The CISA Known Exploited Vulnerabilities (KEV) Catalog is the authoritative, publicly accessible registry of security flaws that have been confirmed to be actively exploited by malicious threat actors in the wild. Maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the catalog serves as an operational baseline to help system administrators, security operations teams, and academic research institutions prioritize remediation on vulnerabilities causing immediate, documented harm.

In modern enterprise environments and academic computing facilities, thousands of new Common Vulnerabilities and Exposures (CVEs) are published annually. In the operational landscape of institutional cybersecurity, the KEV catalog cuts through vulnerability noise by shifting focus from theoretical severity scores to empirical proof of real-world exploitation.

What It Is

The CISA KEV catalog is an operational risk-reduction tool rather than an exhaustive vulnerability repository. While broader databases index every disclosed software flaw, the KEV catalog specifically filters for vulnerabilities that threat actors are actively leveraging in cyber operations, malware campaigns, and ransomware incidents.

For a security flaw to be added to the KEV catalog, CISA enforces three strict qualifying thresholds:

• Assigned CVE ID: The flaw must have an assigned Common Vulnerabilities and Exposures identifier from an authorized CVE Numbering Authority (CNA).
• Active Exploitation in the Wild: There must be reliable, verified evidence that malicious execution was attempted or successfully carried out on a target system without the owner’s permission in real time. Theoretical exploitability or public proof-of-concept (PoC) code alone does not qualify a flaw for inclusion.
• Clear Remediation Action: There must be a specific, actionable vendor security update, technical workaround, or configuration mitigation that organizations can execute to neutralize the threat.

Who Runs It and What It Covers

The catalog is managed and maintained by the Cybersecurity and Infrastructure Security Agency (CISA), an operational component of the U.S. Department of Homeland Security (DHS). Established under federal authority to safeguard national cyber infrastructure, CISA monitors global threat intelligence, incident telemetry, and partner reporting to continuously update the registry.

Originally authorized under Binding Operational Directive (BOD) 22-01 and harmonized under BOD 26-04 (Prioritizing Security Updates Based on Risk), federal civilian executive branch (FCEB) agencies are legally mandated to remediate KEV catalog vulnerabilities within strict operational timelines (typically between 14 to 21 days for newly published entries). Although private corporations, universities, and research laboratories are not legally bound by federal directives, the KEV catalog has become the de facto international benchmark for enterprise vulnerability patch prioritization.

The catalog spans consumer operating systems, enterprise server software, networking hardware, VPN appliances, hypervisors, and cloud infrastructure. Each record provides essential tracking metadata:

• CVE ID: The official Common Vulnerabilities and Exposures tracking identifier.
• Vendor / Project & Product: The affected commercial software vendor or open-source software project and product name.
• Vulnerability Name & Short Description: Summary of the underlying architectural or code defect, frequently mapping directly to CWE (Common Weakness Enumeration) weakness types.
• Required Action & Due Date: Explicit remediation steps and the binding compliance deadline assigned to federal civilian agencies.
• Known Ransomware Campaign Use: An explicit indicator (“Known” or “Unknown”) designating whether threat actors have weaponized the vulnerability within ransomware extortion operations.

How to Search or Use It

Security practitioners, network engineers, and institutional IT teams can query the catalog through interactive web search or automated ingestion pipelines:

1. Interactive Web Query: Navigate to the official portal (cisa.gov/known-exploited-vulnerabilities-catalog) and utilize the web table search filters to query by Vendor, Product, CVE ID, or keyword.
2. Automated JSON / CSV Ingestion: Ingest the authoritative public feeds without requiring an API key. CISA hosts the raw data feeds directly at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json and the corresponding CSV export.
3. Integrate with Vulnerability Scanners: Configure enterprise vulnerability scanners and asset management tools to tag detected institutional assets that match active KEV entries.
4. Enforce Emergency Patch Cycles: Establish expedited change-management workflows that bypass standard monthly patching cycles whenever an asset matches a newly added KEV record.
5. Track Ransomware Associations: Filter the feed for entries where knownRansomwareCampaignUse is marked “Known” to prioritize systems holding mission-critical scientific data or regulated research records.
6. Correlate with Adversary Tactics: Cross-reference active KEV vulnerabilities with the MITRE ATT&CK framework to evaluate whether post-exploitation defenses and logging controls are active.
7. Subscribe to Updates: Subscribe to CISA’s official RSS feed, newsletter alerts, or programmatic webhook integrations to receive immediate notifications when new exploited vulnerabilities are cataloged.

Strengths and Limits

Integrating CISA KEV into institutional risk governance provides clear operational advantages alongside known architectural boundaries:

• Empirical Priority: Eliminates guesswork by separating actively weaponized exploits from theoretical lab vulnerabilities.
• Actionable Due Dates: Provides clear timeframes that security teams can use to justify emergency maintenance windows to academic leadership and system owners.
• Public and Free: Accessible via standard machine-readable JSON and CSV feeds with zero licensing fees or authentication barriers.
• Lagging Indicator: Inclusion in KEV requires verified evidence of in-the-wild exploitation; zero-day exploits being leveraged prior to public discovery will not appear until evidence is confirmed.
• Not a Standalone Scoring System: KEV does not replace predictive risk modeling; it must be paired with predictive tools (such as EPSS) and stakeholder prioritization models (such as SSVC) to evaluate vulnerabilities not yet observed in active campaigns.

Alternatives and Related Vulnerability Prioritization Frameworks

CISA KEV functions as a critical input within a broader ecosystem of vulnerability management standards and registries:

Framework / Registry	Governing Body	Primary Metric / Focus	Complementary Role with CISA KEV
CVE (Common Vulnerabilities and Exposures)	CISA / MITRE	Universal identification catalog for disclosed vulnerabilities.	Baseline identifier; every KEV entry must have an established CVE record.
CVSS (Common Vulnerability Scoring System)	FIRST	Theoretical technical severity and impact score (0.0–10.0).	Measures severity, whereas KEV measures real-world exploitation in the wild.
EPSS (Exploit Prediction Scoring System)	FIRST	Statistical probability (0–100%) that a vulnerability will be exploited in the next 30 days.	Predictive forecast; KEV provides empirical confirmation once exploitation occurs.
SSVC (Stakeholder-Specific Vulnerability Categorization)	CISA / SEI	Decision-tree prioritization based on exploitation, asset exposure, and mission impact.	Directly ingests KEV status as a decision-tree branch to determine whether to Track, Attend, or Act.
NVD (National Vulnerability Database)	NIST	Comprehensive vulnerability database enriched with CVSS, CWE, and CPE metadata.	Provides detailed technical analysis and root-cause weakness mappings for CVEs listed on KEV.

Frequently Asked Questions

What is a CISA KEV?

A CISA KEV refers to an entry in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog. It denotes a specific software or hardware security vulnerability (identified by a CVE) that CISA has confirmed is actively being exploited by cyber attackers in real-world environments.

What does KEV stand for in cybersecurity?

KEV stands for Known Exploited Vulnerabilities. In cybersecurity operations, it refers specifically to CISA’s official list of vulnerabilities that have transitioned from theoretical risks to active attack vectors.

What does CISA stand for?

CISA stands for the Cybersecurity and Infrastructure Security Agency. It is the federal operational agency within the U.S. Department of Homeland Security responsible for coordinating national cybersecurity defense and protecting federal networks and critical infrastructure.

What is the difference between CVE and KEV?

The difference lies in scope and real-world exploitation. A CVE (Common Vulnerabilities and Exposures) is a unique tracking identifier assigned to any publicly disclosed cybersecurity vulnerability—over 250,000 exist, and the vast majority are never exploited in the wild. The KEV catalog is a strictly curated subset (containing approximately 1,700+ entries) representing only those CVEs for which reliable proof of active, in-the-wild malicious exploitation has been confirmed.

Does CISA KEV provide an API or machine-readable feed?

Yes. CISA publishes the entire KEV catalog as a machine-readable JSON file (located at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) and a corresponding CSV file. These feeds are updated continuously, are free to use, and require no API key or developer registration to query.

How does CISA KEV impact research and higher education institutions?

While federal civilian directives (such as BOD 26-04) formally apply to federal executive branch agencies, universities and research institutions use KEV as an authoritative prioritization guide. Safeguarding academic computing networks against KEV vulnerabilities protects high-value research grants, supports CMMC compliance for research institutions, and strengthens defensive postures outlined in threat intelligence programs.

Sources

• Cybersecurity and Infrastructure Security Agency. (2026). Known Exploited Vulnerabilities Catalog. cisa.gov/known-exploited-vulnerabilities-catalog (Accessed 2026-11-08).
• Cybersecurity and Infrastructure Security Agency. (2026). Reducing the Significant Risk of Known Exploited Vulnerabilities. cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities (Accessed 2026-11-08).
• Cybersecurity and Infrastructure Security Agency. (2026). Known Exploited Vulnerabilities JSON Data Feed (v2026.11.06). cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (Accessed 2026-11-08).
• Cybersecurity and Infrastructure Security Agency. (2026). Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk. cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (Accessed 2026-11-08).