KEV (known exploited vulnerabilities)
KEV · Known Exploited Vulnerabilities · KEV catalog · CISA KEV · actively exploited vulnerabilities · BOD 26-04 · BOD 22-01
A public catalogue run by CISA, the US cybersecurity agency, listing the vulnerabilities that attackers are confirmed to have exploited.
In practice
A flaw is only added if three conditions are met: it has a CVE identifier, there is reliable evidence of active exploitation, and a clear remediation exists (a vendor update, for example). Created in November 2021, the catalogue sets remediation deadlines for US federal civilian agencies, now governed by Binding Operational Directive 26-04 of 10 June 2026, which replaced BOD 22-01 and goes down to 3 days for the most dangerous internet-facing flaws. For a European company it is not mandatory, but it remains the best priority signal: a flaw in the KEV is being used by attackers right now. Each entry also states whether the flaw is known to be used in ransomware campaigns.
Fictional case: one Monday morning, a VPN gateway flaw is added to the KEV catalogue. The SME that follows the catalogue patches the same day; the one waiting for its monthly maintenance window discovers an intrusion ten days later.
