How to Read the CISA KEV Catalog
Understand the CISA Known Exploited Vulnerabilities catalog: how to read entries, why KEV matters more than CVSS score alone, what due dates mean, and how to prioritize remediation.
Quick Answer
The CISA KEV catalog lists vulnerabilities known to be actively exploited in the wild, with required actions and remediation deadlines; vulnerabilities on the list should be prioritized for patching even if their CVSS score is moderate.
Definition
CISA's Known Exploited Vulnerabilities (KEV) catalog is an authoritative list of vulnerabilities that have evidence of active exploitation, maintained by CISA to drive federal prioritization and public awareness.
Answer first
KEV = known-exploited in the wild. Check it first; on-list vulnerabilities outrank off-list ones regardless of CVSS.
1. What an entry contains
Each KEV entry identifies the CVE, the vendor and product, a short vulnerability name, the date added, the required action, and the remediation due date.
2. Why it matters
Active exploitation is the strongest real-world signal of risk. A moderate CVSS vulnerability that is actively exploited deserves attention before a high-scoring one with no evidence of exploitation.
3. Interpret due dates
CISA sets remediation due dates (typically 7, 30 or 60 days from addition). Treat them as the expected patch cadence, not a compliance ceiling.
4. Required action
Follow the required action stated in the catalog (e.g., apply vendor updates, discontinue use, apply mitigations). It is written by CISA for federal civilian agencies but useful guidance for everyone.
5. From catalog to action
Look up each CVE in OpenTrojan, confirm affected products in your environment, and record your remediation in an investigation.
6. The CVE → KEV workflow
The KEV catalog is always read against a specific CVE, not in isolation:
- Start from the CVE — look it up with CVE Lookup to get severity, CVSS vector, affected products and whether it appears on KEV.
- Check the KEV entry — confirm the vendor/product name, the date added and the remediation due date; the KEV status is authoritative for “actively exploited”, while the CVSS score tells you about inherent severity.
- Take the required action — follow the remediation written by CISA for that entry.
- Record it — open an investigation tracking each affected asset, its due date and the applied fix, so the search is not lost as a checklist.
A concrete example: CVE-2021-44228 (Log4Shell) is on KEV — its CVSS is critical and it is actively exploited, so it outranks virtually any off-list vulnerability in your backlog.
Tools that help
- CVE Lookup — KEV status alongside CVSS and fixes.
- Investigation Workspace — track remediation.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.