Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

CISA KEV catalogue: Known Exploited Vulnerabilities

In one sentence: The CISA KEV catalogue is a public list of software flaws that attackers are known to be using right now, so you can fix those first.

What it is

The US Cybersecurity and Infrastructure Security Agency (CISA) keeps the Known Exploited Vulnerabilities (KEV) catalogue as a living list of CVEs that carry significant risk. It was created by Binding Operational Directive 22-01, issued on 3 November 2021, to set timeframes for US federal civilian agencies to fix flaws actively exploited by adversaries.

Only US federal civilian agencies must follow it. CISA nonetheless strongly urges all organisations to prioritise fixing KEV entries as part of their vulnerability management.

How it works

CISA says a flaw is added when three criteria are met:

  1. It has a CVE ID.
  2. There is clear remediation guidance, such as a patch or workaround.
  3. There is reliable evidence of exploitation in the wild.

Evidence can come from vendors, researchers, partners or CISA’s own incident response. CISA reviews wording and original sources when news or academic reports claim exploitation. Federal agencies then have a deadline to fix each entry.

What it does not do: CISA says KEV is not meant to be the only way you triage. It recommends using it as an input to a prioritisation framework such as SSVC. A flaw missing from KEV may still be exploited, and a flaw on it may not apply to you.

Note that the original directive page now says it has been revoked and superseded by BOD 26-04. Check CISA’s current catalogue page for the rules in force.

Who it affects and how badly

Anyone who runs software, anywhere. Attackers do not care about jurisdiction. UK and EU firms, US businesses and Armenian organisations all use the same VPNs, file transfer tools and operating systems.

It is especially useful for small and mid-sized firms with no formal vulnerability programme. CISA says KEV is a good starting point if you do not yet have one. MSPs can use it to prioritise client patching. Regulated firms and insurers increasingly ask whether KEV items are fixed. One analysis reports the catalogue reached 1,483 entries by the end of 2025.

Worst case for ignoring it is the standard one: an unpatched, already-attacked flaw on an internet-facing system leads to data theft or ransomware.

Real examples

MOVEit Transfer, 2023. CISA says that, based on evidence of active exploitation of CVE-2023-34362, it added the flaw to the KEV catalogue on 2 June 2023. CISA and the FBI expected widespread exploitation of unpatched systems. Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

Routine additions. CISA publishes alerts each time it adds entries, such as its 17 December 2025 alert adding three, restating that all organisations should prioritise KEV fixes. Source: https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog

How to detect it

  • Build a simple asset list of products and versions. CISA recommends up-to-date asset inventory so you can identify the KEV entries that affect you.
  • Compare the list against the catalogue each week. The catalogue can be downloaded as a spreadsheet or machine-readable file from CISA’s site.
  • In Microsoft Defender Vulnerability Management and most scanners you can filter on known exploited flaws.
  • Sign up for CISA’s alerts and your vendors’ advisories.
  • Check internet-facing systems first.

How to fix or prevent it

  1. Keep an accurate asset list.
  2. Fix any KEV entry that matches your assets, starting with systems exposed to the internet.
  3. Apply the vendor’s patch, or the workaround if no patch exists. If you cannot, remove the product from the internet.
  4. Set your own deadline for KEV fixes, shorter than your normal patch window.
  5. Add context from CVSS and your own business impact. CISA says use KEV as one input.
  6. Re-check weekly.
  7. Retire products that no longer get updates.

Related terms

Browse all entries in the vulnerabilities hub.

FAQ

What gets a flaw onto the KEV catalogue? A CVE ID, clear remediation guidance and reliable evidence of exploitation in the wild.

Do I have to follow it? Only US federal civilian agencies are bound, but CISA urges all organisations to use it.

Is KEV enough on its own? No. CISA recommends using it as one input to a prioritisation framework.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.