Glossary
KEV (Known Exploited Vulnerabilities catalog)
CISA's authoritative list of CVEs with reliable evidence of active exploitation in the wild and a clear remediation action.
The Known Exploited Vulnerabilities (KEV) catalog is maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). It was created under Binding Operational Directive 22-01 in November 2021, and a CVE is only added when three criteria are met: it has a CVE ID, there is reliable evidence that it is being actively exploited, and there is a clear remediation action such as a vendor update.
Each entry carries the affected vendor and product, the required action, the date it was added, a dueDate that is binding for US federal civilian agencies, and a flag showing whether it is known to be used in ransomware campaigns. The catalog is published as CSV and JSON feeds that are easy to join with scanner output.
For a Vulnerability Operations Center, KEV is the strongest free exploitation signal available: a KEV-listed finding should never sit in a low priority tier. It is deliberately conservative, though, so absence from KEV is not proof of safety. See risk-based prioritization for how to combine it with EPSS and asset context.