How a vulnerability gets added to KEV

CISA adds a vulnerability when three conditions are met: it has an assigned CVE ID, there is reliable evidence that it has been actively exploited, and there is clear remediation guidance, such as a patch or mitigation. The catalogue was created in November 2021 under Binding Operational Directive 22-01, which requires US federal civilian agencies to fix listed vulnerabilities by set deadlines.

Why KEV is useful outside the US government

Tens of thousands of CVEs are published every year, but only a small fraction are ever exploited. KEV narrows the list to flaws attackers are known to be using, which makes it one of the most practical prioritisation signals available. Many UK and international organisations use it alongside CVSS to decide what to patch first, especially on internet-facing systems.

How to use KEV in practice

  1. Match the catalogue against your asset inventory and scan results.
  2. Treat any KEV match on an internet-facing system as urgent.
  3. Check new additions regularly, because entries are added frequently and often soon after disclosure.
  4. Remember that absence from KEV does not mean a vulnerability is safe. It may be exploited without public evidence yet.

How DarkInvader helps

DarkInvader flags vulnerabilities on your internet-facing assets that are known to be exploited, including KEV-listed CVEs, so they rise to the top of the fix list instead of sitting among lower-risk findings.

Explore Vulnerability Scanning

Frequently asked questions

Is the CISA KEV catalog free to use?

Yes. It is published openly on the CISA website and is also available as a machine-readable feed that security tools can import.

Do UK organisations have to follow KEV deadlines?

No. The deadlines are mandatory only for US federal civilian agencies. For everyone else, KEV is a strong prioritisation signal rather than a legal requirement.

How is KEV different from EPSS?

KEV lists vulnerabilities with confirmed exploitation. EPSS, from FIRST, estimates the probability that a vulnerability will be exploited in the near future. KEV is evidence-based, EPSS is predictive, and they work well together.

Related terms and reading

Sources