Known Exploited Vulnerabilities

The Known Exploited Vulnerabilities catalog (KEV) is an authoritative, publicly available list of security vulnerabilities that have been actively exploited in the wild. Maintained by the Cybersecurity and Infrastructure Security Agency (CISA) in partnership with organizations like NIST and MITRE, the KEV catalog is designed to help organizations prioritize remediation efforts by focusing attention on vulnerabilities that present the most immediate and significant risks.

Key characteristics of the KEV catalog:

• Includes only vulnerabilities with evidence of active exploitation by malicious actors, based on analysis from security vendors, researchers, government, and open-source reporting.
• Each entry has an assigned CVE ID (Common Vulnerabilities and Exposures identifier) and clear, actionable remediation guidance, such as vendor patches or mitigation steps.
• The catalog is updated regularly as new exploited vulnerabilities are identified and confirmed.
• Federal civilian executive branch (FCEB) agencies are required by law (Binding Operational Directive 22-01) to remediate KEV-listed vulnerabilities within set timeframes, but CISA strongly encourages all organizations—including those in the private sector and state/local governments—to use the catalog to enhance their security posture.

Benefits and usage:

• Prioritization: By focusing on vulnerabilities that are already being exploited, organizations can allocate resources more efficiently and reduce the risk of compromise.
• Actionable intelligence: The catalog provides detailed information, including affected products, exploitation status (such as use in ransomware campaigns), and links to vendor advisories or patches.
• Community defense: By addressing KEV-listed vulnerabilities, organizations contribute to the overall resilience of the cybersecurity ecosystem.

How to access and use:

• The KEV catalog is freely available in formats like CSV and JSON for easy integration with vulnerability management tools.
• Organizations are encouraged to subscribe to updates and incorporate KEV entries into their vulnerability management and patching workflows.