What it means
The KEV catalog identifies vulnerabilities for which CISA has evidence of exploitation in the wild and an actionable remediation path. Membership is a strong signal for prioritization because exploitation is observed, not merely predicted. It does not establish that an attacker reached your organization or that every installation of an affected product is vulnerable. The catalog is also not exhaustive: a vulnerability absent from KEV can still be exploited. CISA’s federal remediation requirements have a defined scope; other organizations should set their own accountable response process.
The idea at a glance / Vulnerabilities
Keep known exploitation separate from your incident.
A KEV entry records known exploitation in the wild. Matching it to a component starts local assessment; it does not decide whether that asset was compromised.
CISA’s 2026-09-29 catalog snapshot lists CVE-2021-44228, added on 2021-12-10. Synthetic G71’s selected inventory contains Apache log4j-core 2.14.1. Maya’s DEC71 records follow-up work. Running-build confirmation, affected conditions, repair, and local investigation remain open.
READ THE PICTURE
Read the evidence and its limits
The pinned CISA entry establishes known exploitation of CVE-2021-44228 in the wild. G71’s component record is a lead for applicability checks, not proof of its running conditions or compromise. Maya records next work; the picture provides no completed repair or local incident verdict.
Keep in mindCatalog membership is not a G71 incident verdict; absence is not evidence of safety. Product/version applicability and local investigation need separate evidence. Federal required actions and due dates have their own scope and are not assigned to this fictional asset. No patch or containment is completed here.
Read the complete example
- Read the evidence and its limits. The pinned CISA entry establishes known exploitation of CVE-2021-44228 in the wild. G71’s component record is a lead for applicability checks, not proof of its running conditions or compromise. Maya records next work; the picture provides no completed repair or local incident verdict. The selected official CISA mirror snapshot has catalogVersion 2026.09.29 and dateReleased 2026-09-29T13:51:33.3852Z. Its revision is 03ee1fcfd18aa54cf2065ab7609e2481bf374dbd. The retained entry identifies CVE-2021-44228, vendor Apache, product Log4j2, and dateAdded 2021-12-10. The addition date is not the time an attacker reached G71. Apache’s advisory identifies log4j-core and includes the selected 2.14.1 version. The fictional inventory is still not proof of the actual running build or all required conditions. Maya’s DEC71 calls for checking the running artifact and current maintainer action, with repair verification and investigation status left open. Consult the applicable current directive and vendor guidance for a real response; an old catalog due date is not a new universal deadline. A patch would not itself establish that earlier persistence or compromise has been removed. A lower model forecast cannot erase observed exploitation, and an unlisted weakness can still warrant action.
Catalog membership is not a G71 incident verdict; absence is not evidence of safety. Product/version applicability and local investigation need separate evidence. Federal required actions and due dates have their own scope and are not assigned to this fictional asset. No patch or containment is completed here.
Diagram references: CISA: Known Exploited Vulnerabilities Catalog · CISA: pinned 2026-09-29 KEV snapshot · Apache: Log4j security advisories
AN ILLUSTRATIVE SCENARIO
A listed vulnerability and an unfinished local review
CISA’s pinned 2026-09-29 snapshot contains CVE-2021-44228, added in December 2021. Fictional G71’s inventory lists log4j-core 2.14.1, a component/version included by Apache’s advisory. Vera’s DEC71 requests confirmation of the running build and affected conditions, current vendor action, and appropriate investigation. This records next work, not a completed patch or a G71 incident. The catalog’s global exploitation evidence remains separate from local findings. A historical federal due date is not automatically a deadline for this fictional asset.
Put it to work
- Match catalog entries to your asset inventory using CVE identifiers and vendor advisories. Verify applicability rather than assuming every product with a similar name is affected.
- Assign a responsible owner, response deadline, and interim mitigation where needed. Consider reachability and service impact, and document exceptions that prevent timely remediation.
- Verify the correction on the running system and assess whether investigation is warranted. Continue monitoring other advisories and findings so catalog absence does not become a blanket exemption.
How to check your work
Select one applicable entry and trace it to affected assets, the vendor’s required action, a completed change, and independent verification. Confirm that any investigation or temporary mitigation still has an explicit owner.
Connect the ideas
- CVE
A public identifier for a specific disclosed vulnerability record.
- EPSS
FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.
- Patch
A vendor or internal change that removes or reduces a vulnerability in running software.
- Incident
An event or set of events that actually or potentially causes a security loss requiring coordinated handling.