The CISA Known Exploited Vulnerabilities catalog, often called KEV, is a list of vulnerabilities that are known to be actively exploited in the wild. CISA maintains the catalog to help organizations prioritize vulnerabilities that attackers are already using, not just vulnerabilities that are theoretically severe.
KEV is important because vulnerability teams face more findings than they can fix immediately. A vulnerability that is known to be exploited usually deserves faster attention than a vulnerability with the same CVSS score but no active exploitation evidence.
How KEV is used
Security teams use KEV as a prioritization signal. When a CVE appears in the KEV catalog, teams should quickly determine whether affected software exists in their environment, whether the asset is internet reachable, whether compensating controls exist, and who owns remediation.
For federal agencies and many regulated teams, KEV also influences remediation expectations and deadlines.
KEV vs CVSS
CVSS measures technical severity. KEV indicates known exploitation. Both matter, but they answer different questions:
- CVSS: How severe could this vulnerability be?
- KEV: Are attackers known to be exploiting this vulnerability?
A high CVSS score does not always mean active exploitation. A KEV entry means exploitation has been observed or confirmed strongly enough to warrant urgent attention.
KEV vs EPSS
EPSS estimates the probability that a vulnerability will be exploited. KEV identifies vulnerabilities already known to be exploited. EPSS is predictive. KEV is evidence-based.
The best programs use both, along with asset context. A KEV vulnerability on an internet-facing production workload is different from the same vulnerability on an isolated test system.
Why cloud context matters
KEV by itself does not know your environment. It cannot tell whether the affected package runs in production, whether the workload is exposed, whether compensating controls exist, or whether sensitive data is reachable.
That is why KEV works best when combined with cloud inventory, runtime context, network exposure, ownership, and attack path analysis.
How Cloudanix helps
Cloudanix correlates KEV and other exploit-intelligence signals with cloud assets, workloads, exposures, identities, and owners. Teams can use Zero-Day Watch, Vulnerability Prioritization, and Reports to move from raw CVE lists to actionable remediation.
Frequently asked questions
What does KEV stand for?
KEV stands for Known Exploited Vulnerabilities.
Is every KEV vulnerability a zero-day?
No. Some KEV entries are newly exploited; others are older vulnerabilities that attackers continue to use.
Should KEV vulnerabilities always be patched first?
They should be reviewed urgently, but priority should also consider exposure, asset criticality, exploitability, data sensitivity, and compensating controls.
How often should teams check KEV?
Continuously. New vulnerabilities can be added at any time, and remediation workflows should react quickly when an affected asset appears in your environment.
