What Is KEV in Cybersecurity?
- David Chernitzky
- Aug 14
- 4 min read
How CISA’s Known Exploited Vulnerabilities help you prioritize patching.
In cybersecurity, speed and focus win. Thousands of new CVEs (Common Vulnerabilities and Exposures) appear each year, but only a subset are actively used by attackers. Known Exploited Vulnerabilities (KEV) are those confirmed to be exploited in the wild. Treating KEVs as your top priority can dramatically cut real-world risk, streamline patching, and strengthen resilience.
KEV, defined
KEV refers to software vulnerabilities that have crossed a critical threshold: there’s credible evidence adversaries are using them right now. Unlike theoretical issues or lab-only proofs of concept, KEVs are tied to active campaigns—ransomware, data theft, initial access for lateral movement, and more. That’s why KEVs deserve immediate attention over generic “critical” items that may not be weaponized.
What is the CISA KEV Catalog?
The Cybersecurity and Infrastructure Security Agency (CISA) maintains the Known Exploited Vulnerabilities (KEV) Catalog—a curated, regularly updated list of CVEs confirmed to be exploited. For defenders, it’s a signal-rich feed that answers a practical question: Which vulnerabilities are attackers actually using right now?
Security teams use the KEV Catalog to:
Identify which CVEs require emergency patching or compensating controls.
Establish SLA-backed patch timelines and track exceptions.
Communicate urgency to leadership with a source that’s clear and authoritative.
Why KEVs matter (and how they reduce risk)
Prioritization that maps to real attacks. With so many disclosures, it’s easy to mis-spend effort. KEVs surface the small subset most likely to cause incidents today.
Efficient resource allocation. When time, budget, and change windows are limited, focusing on KEVs yields the biggest risk reduction per hour spent.
Measurable impact. Rapid remediation of KEVs removes common footholds used for phishing follow-ups, web-app compromises, and device takeovers.
KEV vs. CVE vs. CVSS—what’s the difference?
CVE is the ID that says “a vulnerability exists.”
CVSS is a severity score estimating potential impact and exploitability.
KEV is a curated list of CVEs known to be exploited.
Takeaway: A high CVSS score doesn’t guarantee exploitation. KEV status trumps CVSS when deciding what to fix first.
How a vulnerability becomes a KEV
Discovery & assignment: Researchers, vendors, bug bounties, or even attackers uncover a flaw and it gets a CVE ID.
Observed exploitation: Threat intelligence, incident reports, honeypots, and telemetry confirm active use by adversaries.
Catalog inclusion: CISA adds the CVE to the KEV Catalog, signaling defenders to prioritize remediation.
Turn KEV into action: an operational playbook
1) Continuously ingest KEV
Automate daily ingestion of the KEV list into your vulnerability scanner, CMDB, or SIEM. Tag assets impacted by KEVs so they’re easy to query and report.
2) Map KEVs to your environment
Use accurate software inventory (versions, editions, cloud services, appliance firmware). Identify internet-facing assets first: perimeter gateways, VPNs, WAFs, mail/security appliances, web apps, and exposed APIs.
3) Assign KEV-first SLAs
Internet-facing KEV: emergency change; patch or mitigate ASAP (hours–days).
Internal critical KEV: high priority; ≤7 days.
Non-KEV, high CVSS: follow your standard monthly/quarterly cycle.
4) Apply compensating controls when patching must wait
Temporary exposure reduction (block ports, geo/IP allowlists, disable risky features).
WAF/IDS/IPS virtual patches and vendor signatures.
EDR hardening, strict rules for suspicious child processes, macro/script controls.
Network segmentation or isolation for affected hosts.
5) Verify and close the loop
Re-scan, confirm versions, and check logs/EDR for indicators of compromise tied to the KEV. Update runbooks with lessons learned.
6) Report what leadership cares about
Use a simple dashboard: KEVs open, KEVs past SLA, mean time to remediate (MTTR) KEV, and KEV exposure by business unit/asset tier. This translates technical work into risk reduction.
Best practices for managing KEVs
Monitor the KEV Catalog regularly. Automate alerts; don’t rely on manual checks.
Patch outward-in. Fix internet-facing systems first, then high-value internal assets.
Retire or isolate legacy tech. Old, unsupported products repeatedly show up in KEV-driven incidents.
Correlate with threat intel. Prioritize KEVs linked to campaigns targeting your sector or tech stack.
Tabletop recent KEVs. Validate detection, response steps, and cross-team handoffs before the next emergency.
Common pitfalls to avoid
Treating all CVEs equally. Use KEV to focus.
Letting change windows block emergency fixes. For KEVs, use the emergency process.
Ignoring third parties and SaaS. Include MSP tools, managed appliances, and critical SaaS apps in KEV reviews.
“Patch and forget.” Always validate, monitor for post-patch exploitation attempts, and tune detections.
Example workflow (fast path)
KEV alert arrives for a widely used VPN appliance.
You query asset inventory: 14 internet-facing instances found.
Emergency change approved; upgrade firmware for 10, isolate the remaining 4 behind temporary access controls.
Deploy IDS/WAF virtual patch signatures; hunt for known indicators for 30 days.
Re-scan to confirm versions; close exceptions within 7 days; report MTTR and findings to leadership.
FAQs
Is KEV the same as CVE?
No. CVE is the identifier for a flaw; KEV is the list of CVEs confirmed to be exploited.
How is KEV different from CVE and CVSS?
CVE: Identifier that a vulnerability exists.
CVSS: A severity score estimating potential impact and exploitability.
KEV: A curated list of CVEs confirmed to be exploited.Bottom line: When choosing what to fix first, KEV status trumps CVSS.
Do I still need CVSS if I use KEV?
Yes. Use KEV for “what’s weaponized now,” and CVSS to prioritize the rest of the backlog.
What if I can’t patch a KEV immediately?
Reduce exposure (network controls), apply virtual patches, harden EDR, and accelerate the maintenance window. Document exceptions with an expiration date.
Who maintains the KEV Catalog?
The Cybersecurity and Infrastructure Security Agency (CISA) maintains the public KEV Catalog, adding CVEs once exploitation is confirmed.
Is the KEV Catalog only for U.S. federal agencies?
No. While U.S. federal agencies are required to act on KEVs within deadlines, the catalog is public and widely used by enterprises, SMBs, and critical-infrastructure operators worldwide.
How often is KEV updated?
Regularly. New entries are added as exploitation is verified. Build automation to ingest updates continuously rather than relying on manual checks.
Where do I get the KEV list?
CISA publishes the KEV Catalog openly (browsable and downloadable formats). Most vulnerability scanners and security platforms can ingest it automatically.
How do I check if my environment is affected by a KEV?
Inventory: Maintain accurate software/firmware versions (including appliances and SaaS-connected agents).
Scan & correlate: Match asset data to the KEV list (scanner/CMDB/SIEM).
Validate exposure: Prioritize internet-facing systems first.
What if no vendor patch exists yet?
Use compensating controls until a fix is available:
Virtual patching (WAF/IDS/IPS rules)
EDR hardening and script/macro restrictions
Network segmentation or temporary isolation
Reduce service exposure (close ports, allowlists)