CISA KEV Catalog: How Small IT Teams Can Use It

A small IT team cannot patch everything at once, and severity scores do not say what attackers are using. The CISA KEV catalog does. It is free, updated within about a day of new evidence, and short enough to check against your own estate in an afternoon.

It is also widely misread. The dates in it are deadlines for US federal agencies, and the rule behind those dates changed in June 2026. This page covers what the catalog is, what the dates now mean, and what the public feed shows when you count it.

What gets a flaw into the CISA KEV catalog

CISA's criteria page gives three conditions:

1. The vulnerability has an assigned CVE ID.
2. "There is reliable evidence that the vulnerability has been actively exploited in the wild."
3. "There is a clear remediation action for the vulnerability, such as a vendor-provided update."

Attempted exploitation counts. Scanning, security research and a published proof of concept do not. CISA is explicit that how exploitable a flaw looks is not a criterion: only evidence of use is.

The implementation guidance adds a fourth condition, that the flaw "carries significant risk to U.S. government information systems". The two CISA pages do not reconcile the difference. It matters for a private company in one way: a flaw can be exploited in the wild and still be left off because of what the US government runs.

Who the due dates bind

The catalog sits under a Binding Operational Directive, which CISA defines as "a compulsory direction to federal, executive branch, departments, and agencies". The current one is BOD 26-04, issued on 10 June 2026.

It does not bind anyone else. Contractors are out of scope "unless directed by the governing procurement contract". For everyone outside government, CISA's wording is a recommendation: it "strongly recommends all stakeholders include a requirement to immediately address KEV catalog vulnerabilities as part of their vulnerability management plan".

So the due date on an entry is not your deadline. It is a statement of how fast the US government thinks that flaw must be closed, which is useful information in its own right.

What changed with BOD 26-04

Most articles about the catalog still describe the old rule. BOD 22-01, issued in November 2021, gave agencies two weeks for recent flaws and six months for older ones. Its page is now headed "Revoked".

BOD 26-04 replaces a single clock with four questions about each vulnerable asset:

• Exposure. Is the asset publicly exposed?
• KEV status. Is the flaw in the catalog?
• Automation. Can an attacker automate every step of exploitation?
• Impact. Does exploitation give partial or total control?

The answers map to a timeline in the directive's Table 1. The rows for catalog-listed flaws are below, transcribed from the table image in the directive.

Every catalog entry therefore lands on 3 or 14 days. "Forensic triage" means the agency must also check whether the system was already compromised. The guidance notes one more change: by revoking the older directive, federal agencies are no longer required to use CVSS scores to set priority.

What the feed shows when you count it

The catalog is published as a JSON feed under a CC0 licence. The figures in this section were computed from catalog version 2026.11.10, downloaded on 12 Nov 2026 at 20:46 UTC. The file's SHA-256 hash begins 41c8091a. The script and its full output are published so the numbers can be reproduced.

With seven weeks left, 2026 is already the busiest year since the catalog's first full one. In the 90 days to 13 Nov 2026, 114 entries were added, a little over one a day.

Due dates have shortened sharply

Before the new directive, three weeks was the norm. Since it took effect, every short deadline has been exactly three days, and 78% of new entries carry one. Of those 162, 103 are flagged as needing forensic triage.

Which vendors appear most

A count is not a risk ranking. Microsoft leads partly because so much runs on it. For a typical small office the more useful reading is by product type: 178 entries name a Windows product, 66 name Chromium, and firewall and remote-access vendors (Cisco, Ivanti, Fortinet, Citrix, SonicWall) together account for 220.

Remote management tools used by IT providers appear too, in small numbers: ConnectWise has 4 entries, N-able 5, Kaseya 3 and SolarWinds 11.

The ransomware flag

The feed marks 361 entries, 20.3%, as known to be used in ransomware campaigns. The other 1,418 say "Unknown". The schema defines that as cases where "CISA lacks confirmation". It is an absence of evidence, and should not be read as a lower-risk label.

How do KEV, EPSS and CVSS fit together?

They answer three different questions.

FIRST's EPSS FAQ calls the catalog "a record of history" and EPSS "a forecast". Where a catalog entry has a low EPSS score, its advice is two words: "Follow KEV." The CVSS user guide says base scores "should not be used alone to assess risk".

The same FAQ gives a sense of scale: the catalog lists "roughly 0.5% of published CVEs".

What the catalog does not tell you

• It is not complete. CISA's guidance answers its own question, "Is the KEV Catalog the only list of vulnerabilities that I need to worry about?", with "No." Misconfigurations and flaws without a CVE ID never appear.
• An old entry is not a live campaign. Adding a flaw "does not necessarily indicate that CISA is currently observing active exploitation".
• It knows nothing about your network. Whether a listed product is exposed is decided, in CISA's words, on "an asset-by-asset case".
• There is no built-in change log. The GitHub mirror notes that the catalog "has no inline file revision history". The mirror's commit history fills that gap.

A routine for a team of one or two

1. List what you run. Vendors and products, including firewalls, VPN appliances, remote management agents and browsers. You cannot match a list to an inventory you do not have.
2. Check new entries on a fixed day. The catalog page sorts by date added. At the current rate that is about nine entries a week.
3. Treat a match on an internet-facing system as urgent. That is the combination the federal table gives three days.
4. Push the fix through your device tooling. Central patching is one of the things a management tool buys you; see MDM for small businesses compared by minimum order size.
5. If a matched system was exposed before the fix, check for compromise. The directive requires that of agencies for good reason. If personal data was reachable, the clocks in breach notification deadlines by jurisdiction may already be running.

How these figures were gathered, and what a desk-research label means, is set out on the methodology page.