What is the CISA KEV catalog?
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
The Known Exploited Vulnerabilities (KEV) catalog is a public list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of CVEs that CISA has evidence are being exploited in the wild. If a CVE is on it, attackers are using it against real systems.
What gets a CVE onto the list
CISA describes three conditions: the vulnerability has a CVE ID, there is reliable evidence of active exploitation, and there is clear remediation guidance such as a vendor update or mitigation. A bug that is only theoretically dangerous, or exploited with no published fix path, does not qualify on these terms.
The catalog was created alongside Binding Operational Directive 22-01 in November 2021. See BOD 22-01 explained for what that directive requires.
What each entry contains
Each entry carries the CVE ID, vendor and product, a vulnerability name, the date CISA added it, a short description, the required action, a due date, and a flag for known use in ransomware campaigns. Those are the fields our KEV tracker and JSON feeds are built from.
The ransomware flag is Known or Unknown, and Unknown is not the same as "no". In our dataset 361 of 1,780 CISA-listed CVEs (20%) are flagged as known ransomware use.
What it does not tell you
KEV is a confirmed-exploited list, not a complete one. A CVE missing from it may be exploited and not yet listed, or exploited only in ways CISA has no evidence of. Absence is not safety.
It also says nothing about how bad a bug is in your environment. Scores and severity labels are separate: see CVSS v3.1 vs v4.0 and what EPSS measures.
Across the 1,763 CISA-listed records where we hold a CVSS score, 1,134 (64%) score below 9.0 and 220 (12%) score below 7.0. Being exploited and being rated critical are different things.
Who is on it most
Vendors with the most CISA-listed CVEs in our dataset: Microsoft (392), Cisco (103), Apple (96), Adobe (83), Google (77), Oracle (46). Counts reflect how many entries CISA has listed, which follows attacker interest and CISA's evidence, not a ranking of which vendor writes the worst code.
Other KEV-style catalogs
CISA is not the only list. ENISA's EU vulnerability database and CIRCL publish their own known-exploited catalogs, and they do not always agree on timing or membership. We compare them on catalog-diff.