Photo: Fotis Fotopoulos on Unsplash
CISA's Known Exploited Vulnerabilities list explained
In short: The Known Exploited Vulnerabilities (KEV) catalog is a public list kept by the US Cybersecurity and Infrastructure Security Agency (CISA) of security flaws with evidence of real-world attacks. US federal agencies must fix listed flaws by set deadlines, and organisations worldwide use it to prioritise patching. If a product you use appears on it, update quickly.
Too many flaws, not enough time
Tens of thousands of software vulnerabilities are published every year. No IT team can fix them all at once, so they need a way to decide what comes first. A flaw that is merely possible to attack is less urgent than one criminals are attacking right now. That is the idea behind the Known Exploited Vulnerabilities catalog, usually shortened to KEV.
What the KEV catalog is
The KEV catalog is a free public list maintained by CISA, the US Cybersecurity and Infrastructure Security Agency. A flaw is added when there is reliable evidence that it has been exploited in real attacks, it has an official identifier (a CVE number) and there is clear guidance on how to fix or reduce the risk. Each entry lists the product, a short description, the action required and a due date.
Why the deadlines matter
Under a binding directive, US federal civilian agencies must fix KEV-listed flaws by the stated due date, often within a few weeks and sometimes within days for the most serious cases. Other organisations are not legally required to follow it, but many banks, schools, hospitals and businesses around the world use it as a "patch these first" list, because it is based on actual attacks rather than theory.
Recent examples
- In October 2026 CISA added the Plex2Shell flaws in Plex Media Server after attacks began. See our Plex article.
- Later the same month it added the PHP2Shell flaws in PHP, the language behind many websites. See This week in cyber.
When you see "added to KEV" in the news, read it as: "this is being attacked now; update today".
How you can use it
- Home users: you do not need to read the catalog. Keep automatic updates on, and treat news of a KEV listing for something you own, such as a router, NAS or media server, as a prompt to check for updates.
- Small businesses: list your internet-facing equipment (firewalls, VPNs, remote access tools, email servers) and check the catalog for those vendors every week.
- IT teams: the catalog is available as a downloadable file and data feed, so vulnerability scanners and dashboards can flag KEV-listed issues automatically.
Tip: A flaw not being on the list does not mean it is safe. The KEV catalog only includes flaws with confirmed exploitation, and some attacks are never publicly reported.
Related reading
Read What is a zero-day? for the difference between new and known flaws, and our technical notes on vulnerability prioritisation and patch management.
Similar lists elsewhere
Other national cyber agencies publish their own alerts and advisories, and many security vendors track exploited flaws too. Some organisations combine the KEV catalog with scoring systems that estimate how likely a flaw is to be exploited, to decide what to fix next. Whatever the source, the principle is the same: fix what attackers are using first.
Key takeaways
- The KEV catalog lists vulnerabilities with evidence of real-world exploitation.
- US federal agencies must fix listed flaws by set deadlines; others use it to prioritise.
- "Added to KEV" in the news means the flaw is being attacked now.
- Not being on the list does not mean a flaw is safe; keep updating everything.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.