WTF is CISA KEV?
Short version
The KEV catalog is the US government list of security flaws with reliable evidence of real attacks.
The briefing
- CISA
- The US Cybersecurity and Infrastructure Security Agency.
- KEV
- Its Known Exploited Vulnerabilities catalog.
- The one question
- Is anyone actually getting hit by this?
- Bar 1
- The flaw has a CVE ID.
- Bar 2
- There is reliable evidence it has been actively exploited in the wild.
- Bar 3
- There is a clear fix, such as a vendor update.
- Does not count
- Scanning, security research and a proof of concept are not active exploitation.
- Each entry shows
- A due date and whether the flaw is known to be used in ransomware campaigns.
- Who must act
- US federal civilian agencies must fix entries within set timeframes under Binding Operational Directive 26-04, issued in June 2026.
- Old rulebook
- BOD 26-04 replaced BOD 22-01, so older write-ups will quote the wrong one.
- Everyone else
- Nobody else is bound by it, but CISA strongly recommends every organization watch the list.
- Do not read it backwards
- A flaw with no CVE ID or no clear fix cannot get on it, so missing from KEV does not mean safe.
In the Threat Brief this looks like:
CVE-YYYY-NNNN in ExampleApp is on CISA's list.
About the loudest alarm in this business. The bug has been seen working for real, not just in a lab.
Example only. The product, versions and names are made up.
What to do
- If you run the affected product, move it to the front of the queue.
- Do not wait for a quiet week.
- Do not treat a missing entry as an all clear.
- Want it in your tooling? The catalog also comes as CSV and JSON.