What Is the CISA KEV Catalog?

Last verified on Nov 8, 2026.

The CISA KEV catalog is a list of vulnerabilities that CISA has reliable evidence were exploited in the wild. CISA maintains it as the authoritative source for that status. If a CVE is in KEV, attackers are using it, so it should jump the queue.

The Three Criteria

CISA adds a vulnerability only when all three are true:

1. It has an assigned CVE ID.
2. There is reliable evidence it has been actively exploited in the wild.
3. There is a clear remediation action, such as a vendor update.

On the second criterion, CISA is specific. Active exploitation includes both successful and attempted exploitation, where the attacker's intent is to succeed and the activity is real-time. Scanning, security research of an exploit, and a public proof of concept do not qualify on their own. How easily something could be exploited is also not the test, which is why KEV and CVSS can disagree.

On the third, remediation can be an update, removal of an end-of-life product, a mitigation, or a workaround. That means a zero-day with only a workaround can still qualify.

What an Entry Looks Like

The catalog is published as CSV and JSON. This is the Log4Shell entry from the JSON feed, trimmed:

{
  "cveID": "CVE-2021-44228",
  "vendorProject": "Apache",
  "product": "Log4j2",
  "vulnerabilityName": "Apache Log4j2 Remote Code Execution Vulnerability",
  "dateAdded": "2021-12-10",
  "dueDate": "2021-12-24",
  "knownRansomwareCampaignUse": "Known",
  "cwes": ["CWE-20", "CWE-400", "CWE-502"]
}

Check any CVE from a shell:

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq --arg id "CVE-2021-44228" '.vulnerabilities[] | select(.cveID == $id) | {dateAdded, dueDate, knownRansomwareCampaignUse}'

The feed fetched on 2026-11-08 was catalog version 2026.11.06 with 1,769 entries. Each entry also carries a forensicTriage flag, explained below. See Log4Shell for that entry in context.

From BOD 22-01 to BOD 26-04

CISA created the catalog in 2021 under Binding Operational Directive 22-01. On June 10, 2026, BOD 26-04, "Prioritizing Security Updates Based on Risk", took over, and BOD 22-01 is now marked revoked. The inclusion criteria carry forward unchanged. What changed is how federal agencies set remediation deadlines. Urgency now depends on four questions:

For entries flagged for it, the directive requires the agency to remediate and also carry out a forensic triage to assess whether the system is already compromised. The lesson applies outside government: for an exploited vulnerability, patching is not the end. Check whether you were hit first, as in checking logs for exploit attempts after a CVE.

Using KEV in Your Process

CISA tells organizations to use KEV as an input to their prioritization framework, not as the whole of it. A sensible order:

• Anything in KEV on an internet-facing asset: fix or mitigate now.
• Anything in KEV elsewhere: schedule with a short deadline. The dueDate is a useful default.
• Non-KEV vulnerabilities: rank by EPSS, then severity.

KEV is a lagging indicator by design, because it needs evidence. Pair it with new advisories monitoring for what is not yet listed. Anyone with evidence of exploitation of an unlisted CVE can nominate it to CISA.

KEV in cve.now

cve.now, a free vulnerability feed from Sazabi, checks CISA KEV every few minutes and shows each entry's date added and CISA's due date. Every KEV entry is also listed as critical. Browse the known-exploited feed. Sazabi, an AI-native observability and security platform, also includes a cve.now connector with a list_feed tool that its agent can use to read the kev feed.