Known Exploited Vulnerabilities (KEV) Catalog.

What is the Known Exploited Vulnerabilities (KEV) catalog?

The Known Exploited Vulnerabilities catalog is a list of software and hardware flaws that attackers have been seen using in real attacks. CISA, the United States Cybersecurity and Infrastructure Security Agency, maintains it. CISA describes it as the authoritative source of vulnerabilities that have been exploited in the wild. A vulnerability is a weakness in a system that an attacker can abuse. “In the wild” means used in real attacks, not only shown in a lab.

What is CISA KEV?

CISA KEV is the common name for the same catalog. KEV is short for Known Exploited Vulnerabilities. It is the one list that CISA publishes.

What does a vulnerability need to be added to the catalog?

CISA’s guidance names three conditions for adding an entry.

• It has an assigned CVE ID. A CVE ID is the public identifier given to a known vulnerability.
• There is reliable evidence of active exploitation in the wild.
• Clear remediation guidance is available. Remediation means fixing the problem or reducing the risk.

CISA also invites the community to nominate a vulnerability that is being actively exploited but is not yet listed.

What is the KEV catalog used for?

CISA says the catalog helps every organization better manage vulnerabilities and keep pace with threat activity. CISA recommends that organizations use the KEV catalog as an input to their vulnerability management prioritization framework. In plain terms, this means that a flaw on the list should be considered for early attention, because exploitation has already been observed.

Who has to act on KEV entries?

CISA states that all federal civilian executive branch agencies are required to remediate vulnerabilities in the catalog within prescribed timeframes. This requirement comes from a binding operational directive, which is a compulsory direction CISA issues to those agencies. CISA names BOD 26-04 as the directive that sets these timeframes.

For everyone else, CISA strongly recommends that all stakeholders include a requirement to immediately address KEV catalog vulnerabilities as part of their vulnerability management plan. CISA says every organization, including private industry, can strengthen its security by prioritizing remediation of these vulnerabilities.

A simple illustration

This is a generic illustration only. A team has a long list of open vulnerabilities. One of them also appears in the KEV catalog. Because the catalog shows that attackers have used it in real attacks, the team can decide to move that item up its list.

Is the KEV catalog the same as a list of all vulnerabilities?

No. The catalog is not a list of every known vulnerability. It holds only those that meet CISA’s criteria, including reliable evidence of active exploitation. A flaw that is not listed may still matter. The catalog is one input to a prioritization process, as CISA describes it, not a full replacement for it.

Is the KEV catalog the same as CVSS?

No. CVSS is a scoring system that rates how severe a vulnerability is. The KEV catalog records whether a vulnerability has been exploited in the wild. They answer different questions, and an organization can look at both when it sets priorities.

How do KEV and vulnerability management fit together?

Vulnerability management is the ongoing work of finding, ranking and fixing weaknesses. CISA positions the KEV catalog as an input to that work. Applying fixes is covered by patch management.

CISA listed the three flaws behind the 2023 Predator spyware attempts against an Egyptian opposition candidate as exploited on 25 September 2023.