Known Exploited Vulnerability (KEV).

The CISA Known Exploited Vulnerabilities Catalog lists CVEs with reliable evidence of in-the-wild exploitation against real targets. It was established by Binding Operational Directive 22-01, issued 3 November 2021, which requires U.S. federal civilian executive-branch agencies to remediate listed entries by a published due date — typically two weeks for newly added items, and shorter for the highest-urgency flaws.

To be added, an entry must have a CVE ID, reliable evidence of active exploitation, and clear remediation guidance (usually a vendor patch). Landmark entries include CVE-2021-44228 (Log4Shell), added within days of disclosure in December 2021, and CVE-2017-0144 (EternalBlue), whose ongoing abuse by WannaCry and NotPetya-style worms keeps it operationally relevant years later.

While the catalog is U.S.-government driven, private organizations worldwide treat it as a high-signal prioritization feed — KEV inclusion is one of the strongest signals that a vulnerability deserves emergency patching, since it means someone is already being attacked with it. Because CVSS scores only severity and not real-world exploitation, mature risk-based programs combine KEV membership with CVSS and EPSS (exploit-probability) scores to decide what to patch first.

flowchart TD
  A[New CVE disclosed] --> B{Active exploitation observed?}
  B -- No --> C[Track via CVSS / EPSS]
  B -- Yes --> D[CISA adds to KEV Catalog]
  D --> E[BOD 22-01 due date set]
  E --> F[Federal agencies must remediate]
  D --> G[Private orgs prioritize emergency patch]
  C --> H[Risk-based backlog]
  F --> H
  G --> H