Glossary
CISA KEV
Known Exploited Vulnerabilities
CISA's catalog of vulnerabilities with confirmed active exploitation.
The Known Exploited Vulnerabilities catalog has been maintained since November 2021 by CISA (Cybersecurity and Infrastructure Security Agency), the US cybersecurity agency. It lists vulnerabilities whose real-world exploitation is confirmed, not merely possible.
Three criteria for inclusion: the vulnerability has a CVE identifier, there is reliable evidence of active exploitation, and clear remediation guidance is available (an update, a mitigation or retiring the product). Each entry gives the date added, the required action, a due date and whether use in ransomware campaigns is known.
Directive BOD 22-01 requires US federal civilian agencies to remediate each entry by its due date. For every other organisation the catalog is a prioritisation signal: a CVE in KEV deserves attention before a higher-scored CVE that nobody exploits. The feed is public, in JSON and CSV.
On cveo.tech
Related terms
- Zero-dayA vulnerability exploited or made public before the vendor has released a fix.
- EPSSThe probability, from 0 to 1, that a CVE will be exploited in the next 30 days, published by FIRST.
- CVSSA scoring system for the severity of a vulnerability, from 0.0 to 10.0, maintained by FIRST.
- CVEA unique public identifier assigned to a security vulnerability, in the form CVE-YEAR-NUMBER.