What is the KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is a public list, maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), of vulnerabilities that attackers are known to be using in real attacks. CISA launched it in November 2021 together with Binding Operational Directive (BOD) 22-01, which requires U.S. federal civilian executive branch agencies to remediate every listed vulnerability by its due date. Anyone can download the catalog, and many organizations outside government use it as a short list of flaws that deserve attention first.
What gets a vulnerability listed
CISA adds an entry when three conditions are met:
- The vulnerability has a CVE ID.
- There is reliable evidence of exploitation in the wild. A published proof of concept on its own does not meet this bar.
- There is clear remediation guidance, such as a vendor update or a documented mitigation.
Because of the third condition, a flaw under attack may not be listed until guidance exists. A KEV listing is therefore a strong signal, but the absence of one proves nothing. Some commercial intelligence vendors publish their own known-exploited lists, which are often larger.
What an entry contains
| Field | What it tells you |
|---|---|
| CVE ID, vendor and product | Which flaw and which software |
| Date added | When CISA listed it |
| Required action | Usually apply the vendor's update or mitigation, or stop using the product |
| Due date | The federal deadline, often a few weeks after the date added |
| Known ransomware campaign use | Known or Unknown |
The catalog is published as CSV and JSON, so scanners and vulnerability management platforms can tag matching findings automatically. More than a thousand CVEs are listed, a small fraction of the several hundred thousand that have been published.
Using KEV to set priority
Suppose a monthly scan reports two findings on internet-facing servers: a CVSS 8.8 flaw in a reporting application with no known exploitation, and a CVSS 7.5 flaw in the VPN appliance that CISA added to KEV last week with ransomware use marked Known. The VPN flaw goes first. Its base score is lower, but attackers are already using it and the appliance is reachable from the whole internet. After patching, check the appliance for signs of compromise, because exploitation may have happened before the fix went in. Many private companies adopt the BOD 22-01 approach as policy and treat any KEV entry on an exposed system as an emergency change.
KEV vs. CVSS vs. EPSS
- KEV: a yes-or-no record that exploitation has already been seen.
- EPSS: a probability that exploitation activity will be observed in the next 30 days.
- CVSS: how severe the flaw would be in a generic deployment.
They answer different questions and work best together, with asset criticality and exposure deciding the final order.
KEV catalog on the CompTIA Security+ exam
The KEV catalog is taught with vulnerability prioritization under SY0-801 objective 2.1 and applied when ranking scan and penetration test findings under objective 4.3. KEV is not on the SY0-801 acronym list, so a question may describe the catalog rather than name it, for example as "a government list of vulnerabilities known to be exploited in the wild". When one answer choice is actively exploited or listed in KEV and another simply has a higher CVSS score, the exploited one is usually the right one to fix first. A common trap is the claim that KEV matters only to federal agencies; only the mandatory deadlines are limited to them.