CISA KEV: vulnerabilities with confirmed active exploitation
Among more than 6,000 CVEs published per month, 54 have something the others don't: confirmed active exploitation by the US government. These are the top priority for any security team.
What is the CISA KEV catalog
The Known Exploited Vulnerabilities (KEV) is a catalog maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). An entry in the KEV means CISA has evidence that malicious actors are actively exploiting that vulnerability in real environments — not in a lab.
US federal agencies are required to remediate KEVs within a defined deadline. For the private sector, the KEV functions as a top priority list: if your organization uses any product affected by a KEV, the fix cannot wait for the next maintenance window.
Recent VAIA signals
54
active CISA KEV entries
Of 6,153 CVEs published in 30 days — 0.9% with confirmed active exploitation. Signal: sec-cisa-kev-v2 (92).
559
critical CVEs (CVSS ≥ 9.0)
High score ≠ active exploitation. KEV is the filter that converts "critical on paper" into "critical in practice".
381
HN pts — TanStack Router compromised
Supply chain attack via npm: mainstream framework compromised. Signal: sec-supply-chain-npm-2026 (90).
How to use CISA KEV in practice
- 1Product inventoryMap all products and versions in your environment. Without inventory, you don't know if you're exposed.
- 2Cross with KEV dailyCISA updates the catalog continuously. A new KEV entry can make your infrastructure urgent within hours.
- 3Prioritize patch before the windowKEVs don't wait for monthly maintenance windows. Active exploitation requires response outside the normal cycle.
- 4Communicate to the board as operational riskSecurity is now board language. KEVs are the most concrete argument for prioritizing response resources. Signal: sec-board-language (88).
What to track
- →New KEV entries in Microsoft, Cisco, Fortinet and VMware products — historically the most exploited.
- →Time between CVE publication and KEV entry — the shorter, the more aggressive the threat actor.
- →npm/PyPI packages with advisories related to active KEVs — supply chain amplifies exposure.
- →KEV + critical CVSS correlation: only where both overlap requires immediate action.