Prioritization
What is CISA KEV? How to check if a CVE is being exploited
CISA's Known Exploited Vulnerabilities catalog lists CVEs attackers are using now. What gets a CVE listed, what the fields mean, and how to check yours.
Varaxon Technologies · · 3 min read
What the KEV catalog is
The Known Exploited Vulnerabilities (KEV) catalog is maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). It launched in November 2021 alongside Binding Operational Directive 22-01, which requires US federal civilian agencies to fix listed vulnerabilities by a set due date.
Everyone else can use it for free, and most security teams now treat it as the clearest signal there is: this weakness is not theoretical, someone is using it against real organizations.
What gets a CVE added
CISA adds a vulnerability when three things are true:
- It has an assigned CVE ID.
- There is reliable evidence of active exploitation in the wild, not just a published proof of concept.
- There is clear remediation guidance, such as a vendor patch or mitigation.
That third rule means some exploited issues wait until a fix exists. Other lists, such as VulnCheck KEV, track exploitation more broadly, so a CVE missing from CISA KEV is not proof that nobody is exploiting it.
Reading a KEV entry
| Field | Meaning |
|---|---|
| cveID | The CVE identifier, for example CVE-2024-3400. |
| vendorProject / product | Who makes the affected software and which product. |
| vulnerabilityName | A short name for the issue. |
| dateAdded | When CISA added it to the catalog. |
| dueDate | The deadline for US federal agencies to fix it. A useful benchmark for everyone else. |
| requiredAction | What to do: usually apply the vendor update or mitigations. |
| knownRansomwareCampaignUse | Known if it has been used in ransomware campaigns, otherwise Unknown. |
How to check if a CVE is on the list
- One CVE: use the free CVE checker. It shows the KEV status, the date added, the federal due date, CISA's required action, plus the EPSS score and CVSS severity.
- The whole catalog: CISA publishes it as CSV and JSON on cisa.gov, updated whenever entries are added.
- A whole scan: upload your scanner export to Varaxon Scan Hub, which checks every finding against KEV and puts the exploited ones first.
Using KEV to decide what to fix first
A practical order is: KEV entries known to be used by ransomware, then other KEV entries, then everything else by EPSS and CVSS. Within KEV, put internet-facing systems first. Use CISA's due date as your own target if you don't have one; for new entries it is usually a few weeks or less.
For how KEV fits with the other scores, read CVSS vs EPSS vs CISA KEV and what EPSS scores mean.
Common questions
Is the CISA KEV catalog free?
Yes. It is public and free to download as CSV or JSON from cisa.gov, and free tools like the Varaxon CVE checker look it up for you.
Do private companies have to follow KEV due dates?
No. BOD 22-01 applies to US federal civilian agencies. Many companies, insurers and auditors use the due dates as a benchmark anyway.
How often is the KEV catalog updated?
Whenever CISA confirms new exploitation, often several times a week. Check against the current catalog, not a copy from months ago.
Turn your next scan export into a client-ready report.
Run a free pre-flight check