Guide

CISA KEV explained: what the catalog is, what it is not, and how to use it

How CVEs get into CISA's Known Exploited Vulnerabilities catalog, what each field means, how due dates changed under BOD 26-04, and how to use the feed.

Published 2026-11-11Updated 2026-11-118 min read

The Known Exploited Vulnerabilities (KEV) catalog is the shortest useful answer to the question every vulnerability team asks: which of these thousands of CVEs are attackers actually using? CISA launched it on 3 November 2021 together with Binding Operational Directive (BOD) 22-01. As of catalog version 2026.11.10 it lists 1,779 vulnerabilities. Every dossier on this site starts from it.

This guide explains how entries get in, what each field tells you, how the federal due dates changed in 2026, and how to use the catalog outside the US federal government without over- or under-reading it.

How a CVE gets into KEV

CISA applies three criteria. All three must be met:

The vulnerability has an assigned CVE ID.
There is reliable evidence that it has been actively exploited in the wild.
There is a clear remediation action, such as a vendor update or a documented mitigation.

The second criterion is the strict one. CISA counts attempted and successful exploitation by an actor, including attempts against honeypots or systems that turn out not to be vulnerable. It does not count scanning, security research or a public proof of concept on its own. A PoC on GitHub therefore does not put a CVE into KEV; an observed attack does.

Age does not matter

Nothing in the criteria refers to how old a vulnerability is. CVEs from 2008 still enter the catalog when new exploitation evidence appears. See our analysis Why decade-old CVEs still land in KEV.

Anatomy of an entry

Each record in the JSON feed has the same fields. The ones that matter most for prioritisation are dateAdded, dueDate, knownRansomwareCampaignUse and, since mid-2026, forensicTriage.

Fields of a KEV record (JSON feed)
Field	What it contains	How to use it
cveID	The CVE identifier	Join key against scanner and asset data
vendorProject, product	Vendor and product as named by CISA	Coarse filter; names do not always match CPE or scanner naming
vulnerabilityName	Short title	Human-readable label for tickets
dateAdded	Date CISA added the entry	The date that matters for prioritisation, not the CVE year
shortDescription	One-paragraph description	Context; not a full advisory
requiredAction	What federal agencies must do	Often "apply mitigations ... or discontinue use"
dueDate	Federal remediation deadline	Shows how urgent CISA rates the entry
knownRansomwareCampaignUse	Known or Unknown	Known means CISA has evidence of ransomware use
forensicTriage	Yes or No (new in 2026)	Yes means agencies must check for prior compromise, not only patch
notes	Links to vendor advisories and NVD	Starting point for the fix
cwes	CWE IDs	Weakness class, useful for trend analysis

Two fields are easy to misread. "Unknown" in knownRansomwareCampaignUse does not mean "no"; it means CISA has no confirmed evidence. 361 entries are currently marked Known. And vendorProject counts reflect visibility as much as quality: Microsoft leads with 391 entries, followed by Cisco (103), Apple (96) and Adobe (83), partly because these products are everywhere and closely watched.

Due dates: from BOD 22-01 to BOD 26-04

The dueDate is a federal deadline. Under BOD 22-01, agencies had two weeks for CVEs assigned from 2021 onwards and six months for older ones, unless CISA set a shorter window. In practice, almost every 2025 addition got 21 days.

On 10 June 2026 CISA issued BOD 26-04, "Prioritizing Security Updates Based on Risk". It ties deadlines to four questions: is the asset exposed to the internet, is there evidence of exploitation, can exploitation be fully automated, and does it give the attacker full control? The more of these apply, the shorter the window. Where all four apply, agencies get three days and must run forensic triage to check whether the system was already compromised before patching.

Federal due dates of KEV additions (days from dateAdded to dueDate), computed from the KEV feed
Period	Additions	3 days	14 days	21 days	Other	forensicTriage = Yes
2025	245	0	0	226	19	0
2026-01-01 to 2026-06-09	133	31	55	44	3	0
Since 2026-06-10 (BOD 26-04)	162	126	36	0	0	103

Additions since BOD 26-04 by due window

3 days, forensic triage103 CVEs
3 days, no triage23 CVEs
14 days36 CVEs

The shift is visible in the data: since BOD 26-04, more than three quarters of new entries carry a three-day deadline, and nearly two thirds (103 of 162) require forensic triage. The first entry with forensicTriage set to Yes was added on 25 June 2026.

Only binding for US federal agencies

BOD 22-01 and BOD 26-04 apply to US federal civilian executive branch agencies. For everyone else the due dates are a strong signal of how CISA rates the risk, not an obligation. CISA explicitly encourages other organisations to use the catalog for prioritisation.

What KEV is not

Not a complete list of exploited vulnerabilities. An entry needs a CVE ID, a remediation and evidence CISA considers reliable. Exploited bugs without a fix, without a CVE or with evidence held privately by a vendor can be missing for days or permanently.
Not real-time. Entries often appear days after the first public exploitation report. For zero-days, vendor advisories and threat reports are faster.
Not a severity rating. A medium-CVSS bug can be in KEV, a CVSS 10 can be absent. KEV answers "is it used?", CVSS answers "how bad could it be?".
Not tailored to you. KEV knows nothing about your exposure. An internet-facing VPN appliance and an internal test server with the same CVE are the same entry.

How to use it in practice

Pull the feed, do not scrape the website. CISA publishes JSON and CSV feeds, and the same data is mirrored in the cisagov/kev-data repository on GitHub. Poll once or twice a day and diff on cveID.
Match against assets, not against a CVE list. Join the feed with scanner findings and the asset inventory by cveID, then filter for internet exposure first. That reproduces the most important BOD 26-04 question for your own environment.
Alert on dateAdded. A new KEV entry for software you run should open a ticket automatically, regardless of the CVE year.
Treat forensicTriage = Yes as a hunting cue. Even outside the federal scope, it marks entries where CISA expects that patching alone may leave an attacker in place. Check logs for the exposure window before or while you patch.
Add EPSS for what is not in KEV yet. KEV is evidence-based and lagging; EPSS estimates the probability of exploitation in the next 30 days for every CVE. Used together they cover both confirmed and likely exploitation.
Plan for "discontinue use". Close to half of all required actions (808 of 1,779) include discontinuing the product if no fix is available. For end-of-life systems, that is the only compliant outcome.

Every CVE page on this site shows the current KEV status, due date and ransomware flag next to EPSS and NVD data. Use the CVE search to look up any identifier, or follow new entries in the weekly reports.