CISA KEV

CISA's Known Exploited Vulnerabilities (KEV) catalogue is CISA's list of flaws it has reliable evidence of being exploited in the wild. CISA uses three tests before adding an entry: the flaw has a CVE ID, there is reliable evidence of active exploitation, and there is a clear remediation action such as a vendor update. CISA counts attempted exploitation (including attacks that land on a honeypot or an unpatched-but-not-vulnerable system) as well as successful exploitation. Scanning, security research and a published proof-of-concept exploit on their own do not qualify.

KEV measures exploitation, not severity. CISA states that how easy a flaw is to exploit is not an inclusion test, so a low-scored bug can sit in KEV next to critical ones. Example: on 28 October 2026 CISA added VMware ESX CVE-2026-41709, which Broadcom rates Low (CVSS 2.7), with a federal due date of 11 November 2026. If your intake only fast-tracks 'Critical' or 'High', a KEV listing should override that filter for products you run.

Since 10 June 2026, Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, sets the federal clock. It replaced BOD 22-01 and BOD 19-02 and keeps the KEV inclusion criteria unchanged. Under BOD 26-04 the deadline for each asset depends on four questions: is the asset publicly exposed, is the CVE in KEV, can an adversary automate the exploit, and does exploitation give partial or total control. CISA publishes the last three for each CVE through its Vulnrichment programme; the agency answers exposure itself. The clock starts when CISA adds the CVE to KEV or when the agency first finds the flaw on an asset, whichever comes first.

The highest-risk band in BOD 26-04 carries the label '& forensic triage': remediate or mitigate within three days, then check whether the asset was already compromised, following CISA's forensic triage guidance. Timelines move with the facts. Taking a system off the internet lengthens its deadline, and a new KEV listing shortens it.

For Australian organisations: BOD 26-04 binds only US federal civilian agencies, and CISA's KEV page says so, while urging everyone else to put KEV remediation in their vulnerability management plan. Treat a KEV due date as a strong prioritisation signal, not an Australian legal deadline. A workable rule is that an internet-facing or identity-system product with a new KEV entry gets a named owner and a change record the same day, then a patch, a mitigation, or isolation. For anything internet-facing, ask whether it was compromised before the fix. Pair KEV with the vendor's own advisory and ASD's ACSC alerts. KEV lags fresh zero-days, so a missing entry does not mean the flaw is not being exploited.

Live catalogue: cisa.gov/known-exploited-vulnerabilities-catalog (also published as JSON and CSV). On CyberStack, cards show a KEV due date when CISA has listed the CVE. Where the vendor's rating and KEV point different ways, both are shown and each is credited.