What is CISA’s Known Exploited Vulnerabilities (KEV) catalog?
Short answer
The KEV catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. US federal civilian agencies must fix them by set deadlines, and CISA recommends every organization use the catalog to prioritize patching.
The details
For a small team with limited time, patching anything in KEV that you run, especially on internet-facing systems, is one of the most effective uses of effort.
Useful next reads and tools
Terms explained
- Known Exploited Vulnerabilities (KEV)
- CISA’s Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence that attackers are exploiting them.
- Patch management
- Patch management is the process of finding, prioritizing, testing and installing software updates that fix security flaws.
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more GuideSOC
How I Investigate a Suspicious PowerShell Alert in a SOC Lab
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Read more