What the CISA KEV Catalog Contains
CISA, the US Cybersecurity and Infrastructure Security Agency, started the catalog in November 2021 and still updates it as new exploitation is confirmed. Each entry lists the CVE ID, the vendor and product, a short description, the date CISA added it, the action required, a due date, and whether ransomware groups are known to use the flaw. On 20 October 2026 the catalog held 1,754 entries, and 361 of them carried the known ransomware use flag. Microsoft leads with 390 entries, ahead of Cisco, Apple, Adobe, and Google. Those counts keep growing, so check the live catalog before you quote a number. The table shows five well-known entries.
| CVE | Product | Added | Due date | Ransomware use |
|---|---|---|---|---|
| CVE-2021-44228 | Apache Log4j2 (Log4Shell) | 2021-12-10 | 2021-12-24 | Known |
| CVE-2023-4966 | Citrix NetScaler ADC and Gateway | 2023-10-18 | 2023-11-08 | Known |
| CVE-2017-0144 | Microsoft SMBv1 (EternalBlue) | 2022-02-10 | 2022-08-10 | Known |
| CVE-2019-5786 | Google Chrome Blink | 2022-05-23 | 2022-06-13 | Unknown |
| CVE-2024-1086 | Linux kernel | 2024-05-30 | 2024-06-20 | Known |
Entries copied from the CISA KEV catalog, version 2026.10.20. Check the live catalog for current data.
How a Vulnerability Gets Added to the KEV Catalog
CISA adds a vulnerability when three things are true. It has a CVE ID, so everyone can refer to the same flaw. There is reliable evidence that attackers have exploited it in the wild, not just a proof of concept in a lab. And there is clear guidance to fix it, such as a vendor patch or a mitigation. A high CVSS score or a public exploit alone does not qualify. That is why KEV stays short compared with the full CVE list: it holds only flaws where exploitation is confirmed and a fix exists, so every entry is worth a team’s attention.
BOD 22-01 and Who Must Act
The catalog exists because of Binding Operational Directive 22-01, which CISA issued in November 2021. It requires Federal Civilian Executive Branch agencies to fix each KEV entry by its due date. For recent additions that is usually two to three weeks: Log4Shell was added on 10 December 2021 with a due date of 24 December 2021. Older flaws got longer, and the SMBv1 flaw behind EternalBlue had six months. A due date is a deadline, so it also tells you how urgent CISA considers the flaw. Private companies are not bound by the directive, but CISA urges every organization to use KEV as an input to patch priorities, and we agree.
CISA KEV vs CVSS vs EPSS
These three signals answer different questions, and none is enough alone. CVSS rates how severe a flaw could be. EPSS estimates how likely exploitation is in the next 30 days. KEV confirms that exploitation has already happened. Our stance: a KEV listing beats everything else. If a CVE is on KEV, stop debating its CVSS score and patch it, starting with internet-facing systems. For CVEs that are not listed, use EPSS to rank them inside each CVSS band. That order matters most for small teams, which cannot patch every finding in a week. A flaw can rank low on one scale and high on another, so reading all three avoids surprises.
| Signal | Question it answers | Who publishes it | Changes |
|---|---|---|---|
| CISA KEV | Have attackers already exploited it? | CISA | When CISA adds an entry |
| EPSS | How likely is exploitation in 30 days? | FIRST | Daily |
| CVSS | How severe is the flaw? | NVD and the vendor | Rarely |
How to Use KEV to Prioritize Patching
Follow this sequence and a short KEV list becomes your first patch queue:
- Check every CVE in your scan results against the KEV catalog, or paste the list into the CVE Priority Checker, which flags KEV listings.
- Patch KEV entries first, and start with internet-facing systems because attackers can reach those without any foothold.
- Apply the required action from the catalog entry when no patch exists: vendor mitigations, or stop using the product if there are none.
- Set a short deadline for KEV findings in your remediation policy. The Remediation SLA Generator includes a KEV row for this.
- Recheck the catalog weekly, because CISA adds entries throughout the year.
Limits of the KEV Catalog
KEV is the most reliable priority signal that is free, but it has four limits:
- Remember that KEV is reactive. A flaw appears only after exploitation is confirmed, so a new flaw can be attacked before it is listed.
- Expect gaps. The catalog covers exploitation that CISA has evidence for, and some exploited flaws in niche products never make it in.
- Look beyond severity. KEV says nothing about how damaging a flaw is on your systems, so pair it with CVSS and your asset list.
- Treat “not listed” as “not confirmed”, never as “safe”.
How to Read or Download the KEV Catalog
CISA offers the catalog in several free formats, so you can pick the one that fits your workflow:
- Browse the catalog on the CISA website, where you can search by vendor, product, and date added.
- Download the full catalog as a JSON or CSV file from CISA and load it into a spreadsheet or a scanner.
- Clone the kev-data repository on GitHub if you want the history of changes.
- Subscribe to CISA’s update emails so new entries reach you the day they are added.
Frequently Asked Questions
What does KEV stand for?
KEV stands for Known Exploited Vulnerabilities. It is the name of the CISA catalog that lists software flaws with confirmed exploitation in the wild, along with the action to take and a due date.
Is the KEV catalog only for US government agencies?
No. The directive that created it binds US federal civilian agencies, but the catalog is public and free. CISA encourages every organization to use it when setting patch priorities.
How often is the KEV catalog updated?
CISA adds entries as it confirms exploitation, and the catalog’s version number shows the date of the last update. On 20 October 2026 the version was 2026.10.20 and the catalog held 1,754 entries.
If a CVE is not in KEV, can I ignore it?
No. Not listed only means CISA has not confirmed exploitation. Use EPSS to see how likely it is to be exploited next, and use CVSS for the damage it could do.
Related terms: CVE, CVSS, and EPSS. Sources: the CISA KEV catalog and BOD 22-01.
A website vulnerability scanner finds the CVEs that affect your software. Check which of them are on KEV with the free CVE Priority Checker and patch those first.
