Known Exploited Vulnerabilities (KEV) Catalog.

What Is the Known Exploited Vulnerabilities (KEV) Catalog?

The Known Exploited Vulnerabilities catalog is a list of software and hardware flaws that attackers have been seen using in real attacks. CISA, the United States Cybersecurity and Infrastructure Security Agency, maintains it. CISA describes it as the authoritative source of vulnerabilities that have been exploited in the wild. A vulnerability is a weakness in a system that an attacker can abuse. “In the wild” means used in real attacks, not only shown in a lab.

What Is CISA KEV?

CISA KEV is the common name for the same catalog. KEV is short for Known Exploited Vulnerabilities. It is the one list that CISA publishes.

What Does a Vulnerability Need to Be Added to the Catalog?

CISA’s guidance names three conditions for adding an entry.

• It has an assigned CVE ID. A CVE ID is the public identifier given to a known vulnerability.
• There is reliable evidence of active exploitation in the wild.
• Clear remediation guidance is available. Remediation means fixing the problem or reducing the risk.

CISA also invites the community to nominate a vulnerability that is being actively exploited but is not yet listed.

How Does CISA Decide That a Flaw Is Exploited?

CISA says active exploitation covers both attempted and successful attacks. The attacker must have meant to succeed, and the attack must have happened in real time, in the wild.

Some things do not count. CISA names scanning, security research on an exploit and a public proof of concept. A public proof of concept does not mean a flaw has been or will be exploited, and listing does not require one.

The third condition is a clear fix. That can be a vendor update, a mitigation or a workaround. Federal agencies must remove a product from their networks if it is end of life or cannot be updated.

CISA announces new entries in short alerts. On 13 October 2026 it added two flaws, one in Microsoft Windows and one in Ivanti Connect Secure, citing evidence of active exploitation. On 21 October 2026 the catalog held 1,754 entries. An old bug can still be added: the GNU Inetutils telnetd bypass CVE-2026-24061 is a bug from 2015 that CISA added to the catalog in January 2026.

An entry can be old. CISA added the 2024 Apple WebKit flaw CVE-2024-27834 to the catalog on 4 November 2026, more than two years after Apple fixed it.

What Is the KEV Catalog Used For?

CISA says the catalog helps every organization better manage vulnerabilities and keep pace with threat activity. CISA recommends that organizations use the KEV catalog as an input to their vulnerability management prioritization framework. In plain terms, this means that a flaw on the list should be considered for early attention, because exploitation has already been observed.

Who Has to Act on KEV Entries?

CISA states that all federal civilian executive branch agencies are required to remediate vulnerabilities in the catalog within prescribed timeframes. This requirement comes from a binding operational directive, which is a compulsory direction CISA issues to those agencies. CISA names BOD 26-04 as the directive that sets these timeframes.

For everyone else, CISA strongly recommends that all stakeholders include a requirement to immediately address KEV catalog vulnerabilities as part of their vulnerability management plan. CISA says every organization, including private industry, can strengthen its security by prioritizing remediation of these vulnerabilities. Business software is on the list too: CISA added the Metabase SQL injection CVE-2026-72898 on 11 August 2026.

What Do the Due Dates Mean?

Every entry shows the date CISA added it and a due date. The due date binds US federal civilian agencies. Other organizations are not bound by it, but it shows how fast CISA expects the fix.

Due dates vary. Ivanti Connect Secure CVE-2026-104935 was added on 13 October 2026 and due on 16 October. BeyondTrust Remote Support CVE-2026-102764 was added on 16 October and due on 19 October. Both entries also require a forensic triage, which is a check on whether the system was already compromised. Siemens Software Center CVE-2026-110936 was added on 20 October and is due on 3 November, with no triage required.

The rules come from BOD 26-04, which CISA issued on 10 June 2026. It replaced BOD 22-01, the 2021 directive that created the catalog, and it keeps the same listing criteria. Under BOD 26-04 the deadline depends on four things:

• whether the asset faces the internet;
• whether the flaw is in the catalog;
• whether an attacker can automate the exploit;
• how much control the attacker gains.

How Do You Use the Catalog?

Start from the official CISA catalog. Six steps turn it into a patch list.

1. Open the catalogDownload it as CSV or JSON so your tools can read it.
2. List what you runNote the product versions and which systems face the internet.
3. Match the list to the catalogCompare by vendor, product or CVE ID.
4. Fix the matches firstStart with the nearest due date and the internet-facing systems. Follow the required action in the entry: update, mitigate or stop using the product.
5. Read two fieldsCheck whether the flaw is known to be used in ransomware campaigns and whether forensic triage is required.
6. Sign up for CISA email updatesNew entries reach you when they are added.

Here is how it works in practice. A team that runs Siemens Software Center finds CVE-2026-110936 in the catalog. The entry points to the vendor advisory SSA-580366, which says to update to version 4.0.9.8 or later. The due date is 3 November 2026.

Use the catalog next to a severity score, not instead of one. Our guide to CVSS, EPSS and CISA KEV shows what each signal tells you.

Is the KEV Catalog the Same as a List of All Vulnerabilities?

No. The catalog is not a list of every known vulnerability. It holds only those that meet CISA’s criteria, including reliable evidence of active exploitation. A flaw that is not listed may still matter. The catalog is one input to a prioritization process, as CISA describes it, not a full replacement for it.

Is the KEV Catalog the Same as CVSS?

No. CVSS is a scoring system that rates how severe a vulnerability is. The KEV catalog records whether a vulnerability has been exploited in the wild. They answer different questions, and an organization can look at both when it sets priorities.

How Do KEV and Vulnerability Management Fit Together?

Vulnerability management is the ongoing work of finding, ranking and fixing weaknesses. CISA positions the KEV catalog as an input to that work. Applying fixes is covered by patch management.

CISA listed the three flaws behind the 2023 Predator spyware attempts against an Egyptian opposition candidate as exploited on 25 September 2023.

Recent KEV Listings and Analysis From Brandefense

These pages follow the catalog closely.

• CISA KEV additions, 13 to 16 October 2026: patch order gives a patch order for the latest entries.
• Ivanti Connect Secure CVE-2026-104935 was added on 13 October 2026.
• BeyondTrust Remote Support flaw was added on 16 October 2026.
• Siemens Software Center CVE-2026-110936 was added on 20 October 2026.
• PAN-OS CVE-2026-0257 was added on 29 May 2026. The catalog marks it as used in ransomware campaigns.
• KEV due-date windows and pace of additions, days from CVE publication to listing and ransomware-linked entries add data on the catalog.
• How to respond to actively exploited vulnerabilities covers what to do when a flaw on your list is added.

To match catalog entries to your own technology, see vulnerability intelligence.