What is the CISA KEV catalog — and how to actually use it

Every security team drowns in vulnerabilities. The CISA KEV catalog is the US government’s answer to the only question that cuts through the noise: which ones are attackers actually using?

What KEV is

KEV stands for Known Exploited Vulnerabilities. It’s a public catalog maintained by CISA (the US Cybersecurity and Infrastructure Security Agency) containing only vulnerabilities with confirmed exploitation in the wild. Not proof-of-concept code on GitHub. Not “critical severity.” Confirmed, observed attacks.

That filter makes it tiny and precious: roughly 1,500 entries, against a CVE universe of over 250,000. Each entry names the vendor, the product, the date it was added, a remediation deadline for US federal agencies — and, since 2023, a flag that says whether it’s known to be used in ransomware campaigns. As of 9 November 2026, 362 entries carry that ransomware flag by our count of the public catalog.

Why it exists

Before KEV, prioritisation ran on CVSS severity scores — and severity is a theory about what a bug could do, not evidence about what attackers are doing. The result was a decade of teams patching high-scoring bugs nobody exploited while attackers walked through medium-scoring ones everyone deprioritised.

KEV flips the logic: exploitation evidence first. If it’s on the list, someone is already in somebody’s network through that hole.

How to actually use it (the part most teams skip)

1. Diff it against your estate, automatically. The catalog is a free JSON feed. Pull it daily, match it against your scanner output or software inventory, and alert on intersections. This is an afternoon of scripting that outperforms most expensive prioritisation products.

2. Treat the ransomware flag as a tier above everything. A KEV entry with the ransomware flag that matches your estate is not a vulnerability-management item — it’s a pre-incident finding. The crews using it are running a business; when initial access via that CVE gets cheap, they scale it.

3. Steal the federal deadline discipline. US agencies are legally bound (BOD 22-01) to remediate each entry by its due date. You aren’t — but “KEV entries get fixed within 14 days, no exceptions process” is the single highest-value patching policy sentence ever written, and it’s free.

4. Watch the adds, not just the list. New entries land most weeks. The day a CVE joins KEV is the day its exploitation went from niche to confirmed — that’s your trigger, not Patch Tuesday.

What KEV is not

Honesty matters here. KEV is not comprehensive — exploitation has to be observed and confirmed before a CVE is added, so there is always a gap between first exploitation and listing. It’s not a substitute for basics — most ransomware incidents still start with phishing, stolen credentials or exposed remote access, not CVEs at all. And it’s not an ICS feed — most industrial-controls vulnerabilities never reach KEV because exploitation in OT environments is rarely observed and confirmed publicly.

The right mental model: KEV is the floor, not the ceiling. Anything on it is unambiguous. Plenty of real risk lives below it.

Go deeper

We bridge the public KEV catalog into the Ninja Signal threat graph and connect it to live ransomware activity — which crews cite which CVEs, with the government advisory as the receipt, in the ransomware tracker. Daily movements show up in Probably Fine Daily. Related: CVE vs CVSS vs EPSS vs KEV and supply chain attacks explained.