CISA KEV: What the Catalog Is and How It Works

CISA KEV is the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency: a public list of CVEs that CISA has reliable evidence are being actively exploited in the wild. A KEV listing means attackers are using the flaw now, not that they might.

How the catalog works

CISA created the catalog in November 2021 under Binding Operational Directive 22-01. The directive requires U.S. federal civilian executive branch agencies to fix listed vulnerabilities by a due date set for each entry. Anyone else can use the catalog too. It is published as a web page and as machine-readable JSON and CSV feeds.

A vulnerability is added only when three criteria are met:

• It has an assigned CVE ID.
• There is reliable evidence of active exploitation, meaning an attempted or successful attack. A published proof-of-concept or a scan does not count.
• There is clear remediation guidance, such as a vendor update.

Each entry records the vendor and product, the date added, the required action, the due date, and whether the flaw is known to be used in ransomware campaigns. Because the evidence bar is high, the catalog covers well under 1% of published CVEs. It also lags reality: exploitation often begins before CISA confirms it.

How GeekWala uses CISA KEV

GeekWala flags every dependency vulnerability that appears in the KEV catalog, shows the date it was added, and ranks KEV-listed findings above everything else. A KEV entry answers the question EPSS can only estimate, because exploitation has already been observed. When a KEV-listed CVE affects a package you depend on, fix it first. Because GeekWala checks the catalog on every scan, a dependency that was safe last week can jump to the top of your queue the moment CISA adds a new entry for it — no code change required, just a change in what is known to be under attack.

Sources: CISA — Known Exploited Vulnerabilities Catalog · CISA — BOD 22-01

Related terms

• EPSS (Exploit Prediction Scoring System)
• CVSS (Common Vulnerability Scoring System)
• VEX (Vulnerability Exploitability eXchange)

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 13, 2026