KEV

What it means

The KEV catalog identifies vulnerabilities for which CISA has evidence of exploitation in the wild and an actionable remediation path. Membership is a strong signal for prioritization because exploitation is observed, not merely predicted. It does not establish that an attacker reached your organization or that every installation of an affected product is vulnerable. The catalog is also not exhaustive: a vulnerability absent from KEV can still be exploited. CISA’s federal remediation requirements have a defined scope; other organizations should set their own accountable response process.

Put it to work

1. Match catalog entries to your asset inventory using CVE identifiers and vendor advisories. Verify applicability rather than assuming every product with a similar name is affected.
2. Assign a responsible owner, response deadline, and interim mitigation where needed. Consider reachability and service impact, and document exceptions that prevent timely remediation.
3. Verify the correction on the running system and assess whether investigation is warranted. Continue monitoring other advisories and findings so catalog absence does not become a blanket exemption.

How to check your work

Select one applicable entry and trace it to affected assets, the vendor’s required action, a completed change, and independent verification. Confirm that any investigation or temporary mitigation still has an explicit owner.

Connect the ideas

• CVE

  A public identifier for a specific disclosed vulnerability record.

• EPSS

  FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.

• Patch

  A vendor or internal change that removes or reduces a vulnerability in running software.

• Incident

  An event or set of events that actually or potentially causes a security loss requiring coordinated handling.

Explore a field lesson

• Threat, vulnerability, likelihood, impact, and uncertainty
• Prioritize vulnerabilities and exposures