# WTF is CISA KEV?

> Sarge says: On CISA's list means it has been seen working for real. Front of the queue.

- Term: CISA KEV
- Also called: KEV; KEV catalog; KEV list; Known Exploited Vulnerabilities; Known Exploited Vulnerabilities catalog; on CISA's list; CISA's list
- Section: Under attack
- Web page: https://codemarine.ai/learn/cisa-kev/

## Short version

The KEV catalog is the US government list of security flaws with reliable evidence of real attacks.

## The briefing

- **CISA:** The US Cybersecurity and Infrastructure Security Agency.
- **KEV:** Its Known Exploited Vulnerabilities catalog.
- **The one question:** Is anyone actually getting hit by this?
- **Bar 1:** The flaw has a CVE ID.
- **Bar 2:** There is reliable evidence it has been actively exploited in the wild.
- **Bar 3:** There is a clear fix, such as a vendor update.
- **Does not count:** Scanning, security research and a proof of concept are not active exploitation.
- **Each entry shows:** A due date and whether the flaw is known to be used in ransomware campaigns.
- **Who must act:** US federal civilian agencies must fix entries within set timeframes under Binding Operational Directive 26-04, issued in June 2026.
- **Old rulebook:** BOD 26-04 replaced BOD 22-01, so older write-ups will quote the wrong one.
- **Everyone else:** Nobody else is bound by it, but CISA strongly recommends every organization watch the list.
- **Do not read it backwards:** A flaw with no CVE ID or no clear fix cannot get on it, so missing from KEV does not mean safe.

## In the Threat Brief this looks like

> CVE-YYYY-NNNN in ExampleApp is on CISA's list.

About the loudest alarm in this business. The bug has been seen working for real, not just in a lab.

Example only. The product, versions and names are made up.

## What to do

- If you run the affected product, move it to the front of the queue.
- Do not wait for a quiet week.
- Do not treat a missing entry as an all clear.
- Want it in your tooling? The catalog also comes as CSV and JSON.

## Official sources

- [CISA: Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities)
- [CISA: BOD 26-04, Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)

## Related

- [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md)
- [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md)
- [CVSS](https://codemarine.ai/learn/cvss-severity.md)