The CISA KEV List: What It Is and How to Use It in Your Remediation Queue
The CISA KEV list is the Known Exploited Vulnerabilities catalog, maintained by the Cybersecurity and Infrastructure Security Agency. It names vulnerabilities that have been exploited in the wild. CISA says organizations should use it as an input to their vulnerability management prioritization. This guide explains what is in it and how to use it with CVSS and EPSS.
What the KEV catalog is
CISA describes the catalog as the authoritative source of vulnerabilities that have been exploited in the wild. It exists to help network defenders and every organization keep pace with threat activity.
The key idea is simple. A vulnerability on the list is not a theory. It is a flaw that has been used against real targets.
What each entry shows
Each entry on the catalog page includes:
The vendor or project and the product
The CVE identifier and a short description
The date the entry was added
A required action and a due date
Whether the flaw is known to be used in ransomware campaigns, shown as known or unknown
Links to vendor advisories and related notes
The catalog is also available to download as CSV and JSON, so you can load it into your own tools.
What the due dates mean for you
The due date on each entry is part of the catalog. Organizations can use the dates as a signal of how urgently CISA wants the item handled.
KEV, CVSS and EPSS: three different questions
CVSS asks: how severe is the flaw? FIRST describes CVSS as a way to produce a numerical severity score, which can be translated into low, medium, high and critical. CVSS is currently at version 4.0.
EPSS asks: how likely is exploitation soon? FIRST describes EPSS as a model that estimates the probability a published CVE will be exploited in the wild in the next 30 days. It publishes a score from 0 to 1 daily, free of charge.
KEV asks: has it already been exploited? It is a catalog of confirmed exploitation, not a prediction and not a severity rating.
Used together, they cover severity, likelihood and proof. No one of them is enough alone.
How to put KEV in your remediation queue
Match the catalog to your findings. Compare KEV CVE identifiers against your scan results. Automate this with the CSV or JSON feed.
Move matches to the top tier. A finding that appears on the list and affects a system you run should jump the queue.
Check exposure. A listed flaw on an internet-facing system is more urgent than the same flaw on an isolated one. Use your asset list.
Use CVSS and EPSS for everything else. Most of your findings will not be on the list. For those, severity and exploit likelihood still decide the order.
Set an owner and a date. Pick a target date for each listed item and record any exception, with who approved it.
Re-check often. CISA adds entries over time, so a finding that was not listed last week may be listed today. Run the match on a regular schedule.
A simple matching example
Say your scanner exports a list of findings, each with a CVE identifier, a severity score and the asset it affects. You download the KEV catalog as CSV and compare the two lists on the CVE identifier.
Every finding that matches gets a flag. Now look at the flagged items by asset. A match on a public web server goes to the top of the queue with a named owner and a date. A match on an internal system that is hard to reach still gets a date, but it may sit one tier lower while you confirm exposure.
The findings that did not match are not ignored. They stay in the queue, ordered by CVSS, EPSS and asset context.
Using the ransomware flag
Each entry says whether the flaw is known to be used in ransomware campaigns. Treat a "known" value as one more reason to move the item up, especially on systems that hold data your business cannot afford to lose. An "unknown" value does not mean safe. It means CISA has no confirmed information to show on that point.
What KEV does not tell you
It is not a full list of every exploited flaw. CISA invites people to nominate missing items, so a flaw that is not listed may still be exploited.
It does not know your environment. You still decide how exposed each system is.
It does not tell you how to fix an item. The entry points to vendor guidance.
Frequently asked questions
What is the CISA KEV list?
It is the Known Exploited Vulnerabilities catalog that CISA maintains. It lists vulnerabilities that have been exploited in the wild.
Who should use it?
Any organization can use it. CISA says organizations should use it as an input to their vulnerability management prioritization.
Is KEV the same as CVSS or EPSS?
No. CVSS rates severity. EPSS estimates the chance of exploitation in the next 30 days. KEV lists flaws already exploited.
Can I download the catalog?
Yes. CISA offers CSV and JSON versions, so you can match it to your findings automatically.
Next step
Matching a feed to your findings is easy. Turning it into steady, owned remediation is harder. KG Solutions can help you build that process.
To see how well your process handles listed vulnerabilities today, start with a vulnerability management maturity assessment. For steady follow-through, see our ongoing program oversight, continuous remediation support and other vulnerability management services.
Comments