A vulnerability scanner scans the system for any vulnerabilities that are listed as CVEs and queues them for remediation. But that still leaves IT teams with an important question: Does this vulnerability require immediate action, or can it wait behind more pressing risks?
This becomes harder when teams are managing thousands of vulnerabilities across endpoints, applications, and infrastructure. Severity scores provide useful context, but they do not always show whether attackers are actively exploiting a vulnerability in real-world environments.
The CISA KEV catalog helps fill that gap. It identifies vulnerabilities with confirmed evidence of exploitation. This gives IT and security teams an additional signal for prioritizing remediation based on actual attacker activity rather than severity alone.
What is CISA?
The Cybersecurity and Infrastructure Security Agency (CISA) is a U.S. federal agency within the Department of Homeland Security. It aims to minimize cybersecurity and IT risks affecting government organizations, critical infrastructure, businesses, and the broader digital ecosystem.
As part of this role, CISA publishes cybersecurity guidance, alerts, vulnerability information, and other resources that organizations can use to strengthen their security posture. One such resource is the KEV catalog.
What is KEV?
Known Exploited Vulnerabilities (KEVs) refers to security vulnerabilities for which there is reliable evidence that attackers have exploited them in real-world environments.
A vulnerability being technically exploitable does not automatically make it a KEV. According to the criteria described for the catalog by CISA, a vulnerability must have a CVE identifier, proven evidence of exploitation by an attacker, and actionable remediation guidance before it qualifies for inclusion.
This makes KEV an important metric for prioritizing vulnerabilities. Instead of showing what an attacker might exploit, it highlights vulnerabilities that attackers have already demonstrated an ability and willingness to use.
What is the CISA KEV catalog?
The CISA KEV catalog is a publicly available, continuously updated list of hardware and software vulnerabilities that have been actively exploited in real-world attacks.
Each vulnerability in the catalog is associated with information that helps teams identify and remediate the issue, including details such as:
- CVE identifier
- Affected vendor and product
- Vulnerability name and description
- Date the vulnerability was added
- Required remediation action
- Remediation due date
- Relevant notes or references
The catalog acts as more than just another vulnerability database and provides organizations with a focused subset of known vulnerabilities where real-world exploitation has already been established.
CISA previously used the catalog as part of Binding Operational Directive (BOD) 22-01. However, that directive was superseded by BOD 26-04, which now requires U.S. Federal Civilian Executive Branch agencies to remediate listed vulnerabilities using a tiered, risk-based approach rather than fixed deadlines. Other organizations that are not subject to these federal requirements can still use KEV as an input for their own vulnerability prioritization and patching processes.
KEV vs. CVE: What is the difference?
KEV and CVE are closely related, but they serve different purposes.
CVE is a publicly disclosed catalog of computer security and software vulnerabilities. A CVE identifier gives security teams, vendors, scanners, and other tools a common reference for discussing the same vulnerability.
A KEV, on the other hand, indicates that a CVE has evidence of exploitation in real-world attacks. Every KEV entry therefore has a CVE identifier, but only a small subset of CVEs become part of the KEV catalog.
| Aspect | CVE | KEV |
|---|---|---|
| Established by | MITRE Corporation | CISA |
| Purpose | Identifies a publicly known vulnerability | Identifies vulnerabilities known to have been exploited |
| What it tells IT teams | A vulnerability exists | Attackers have exploited the vulnerability in the wild |
| Scope | Broad catalog of publicly disclosed vulnerabilities | Smaller, curated subset of CVEs |
| Proven Exploitation | No | Yes |
| Primary use | Vulnerability identification and tracking | Vulnerability prioritization and remediation |
| Remediation guidance | Depends on accompanying vendor or vulnerability information | Includes a required action for catalog entries |
The distinction becomes important during prioritization. A scanner may identify many CVEs across an environment, including several with high severity ratings. If some of those vulnerabilities also appear in KEV, teams gain another strong reason to move them higher in the remediation queue because exploitation is no longer theoretical.
KEV should not replace broader CVE monitoring or other risk signals. Vulnerabilities that are not currently listed in KEV can still represent serious risks depending on exploitability, asset exposure, business importance, and potential impact.
How does the KEV catalog help IT teams?
For IT teams dealing with large vulnerability backlogs, KEV provides an evidence-based way to decide where remediation resources should be concentrated.
Here are some of the primary ways KEV can support vulnerability management:
- Prioritize actively exploited vulnerabilities: Teams can identify CVEs that appear in KEV and move them ahead of vulnerabilities for which exploitation has not been observed.
- Improve patch prioritization: KEV gives patch management teams an additional prioritization factor alongside severity scores, asset criticality, exposure, and business impact.
- Cut through unnecessary noise: KEV helps IT teams focus on vulnerabilities associated with demonstrated attacker activity rather than the ones with potential exposure.
- Reassess existing vulnerabilities: A CVE that previously had a lower remediation priority may require immediate reconsideration if CISA later adds it to KEV.
- Support risk-based vulnerability management: KEV adds real-world exploitation evidence to technical vulnerability data, helping teams make remediation decisions based on more than severity scores alone.
- Guide remediation actions: Catalog entries identify actions organizations should take to address affected systems, such as applying vendor updates or following specified mitigation guidance.
- Enable automated prioritization: Since KEV information is available in machine-readable formats, organizations can incorporate it into vulnerability scanning, ticketing, patch management, or security workflows to flag affected systems faster.
For example, suppose a vulnerability scanner detects two vulnerabilities: one has a very high severity score but no evidence of active exploitation, while another has a lower score but appears in KEV. Severity remains important, but the KEV listing tells the IT team that attackers are already using the second vulnerability against real systems.
That information can materially change which patch gets deployed first.
KEV is therefore most useful when combined with additional context. Asset criticality, internet exposure, available mitigations, CVSS scores, threat intelligence, and the potential business impact of a compromise should still contribute to the final remediation decision.
Use KEV as a signal for faster, more contextual vulnerability prioritization
The CISA KEV Catalog gives IT and security teams a practical way to distinguish vulnerabilities that are merely known from those with confirmed evidence of exploitation. That makes KEV especially useful when teams need to decide where limited remediation capacity should be focused.
Veltar vulnerability management software brings this context to endpoint vulnerabilities by combining CISA KEV data with CVSS, EPSS, and endpoint context. This helps IT teams target vulnerabilities with confirmed exploitation activity, understand which managed endpoints are affected, and prioritize remediation based on more than severity alone.
