Every year, tens of thousands of new vulnerabilities receive a CVE number. No team can patch all of them immediately, and most don’t need to: only a small share is ever used in real attacks.
The hard part is knowing which ones. That is where the Known Exploited Vulnerabilities (KEV) catalogue comes in.
What is the CISA KEV catalogue?
The KEV catalogue is a public list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). A vulnerability is only added when there is reliable evidence that attackers are actively exploiting it, and when there is a clear fix or mitigation.
US federal agencies are required to fix KEV entries within set deadlines (under Binding Operational Directive 22-01). For everyone else the list is voluntary, but it has become one of the most useful signals in the industry for one simple question: is anyone actually using this? The catalogue also marks vulnerabilities known to be used in ransomware campaigns.
Why CVSS alone is not enough
The CVSS score (0 to 10) describes how severe a vulnerability could be: how easy it is to exploit and how much damage it can do. It does not say whether anyone is exploiting it.
That leads to a familiar problem. A scanner returns 400 findings, 60 of them “critical”. The team works through the critical list, while an older vulnerability rated “high” on the VPN gateway is the one ransomware groups are using right now.
A simple way to prioritise
Combine three questions:
- Is it actively exploited? If it is on the KEV list, it moves to the top.
- Is the system reachable from the internet? VPN gateways, firewalls, email servers, file-transfer tools and web applications are the favourite entry points.
- How important is the system? A vulnerability on your payment or identity system matters more than one on a test machine.
A practical rule many teams use:
| Situation | Target |
|---|---|
| KEV + internet-facing | Today, or isolate the system until you can patch |
| KEV + internal | Within days |
| Not in KEV, CVSS critical | Next planned patch window |
| Everything else | Regular maintenance cycle |
Some teams also look at EPSS, a public score from FIRST that estimates the probability that a vulnerability will be exploited in the next 30 days. It is useful for the large group of vulnerabilities that are not (yet) in KEV.
Patching is not always enough
For several well-known edge-device vulnerabilities, attackers stole session tokens or planted backdoors before the patch was applied. After patching an exploited vulnerability on an internet-facing device, follow the vendor’s advice: end active sessions, rotate credentials and check for signs of compromise.
How OZAG Security helps
OZAG Security checks every vulnerability on your systems against the KEV catalogue and ranks your assets by real risk: exposure, business importance, open detections and unpatched known-exploited CVEs. Our public Threat watch lists every vulnerability confirmed as exploited in the last six months, updated daily. Try it free for 14 days.