The Known Exploited Vulnerabilities catalog, commonly called KEV, is a curated list maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of software vulnerabilities with confirmed evidence of active exploitation in the wild. Unlike databases that list all known vulnerabilities, KEV only includes entries where exploitation has been verified, making it a high-signal source for prioritizing the vulnerabilities that attackers are actually using right now.
The Known Exploited Vulnerabilities catalog is CISA's authoritative list of vulnerabilities that are confirmed to be actively exploited by threat actors. Launched in November 2021 alongside Binding Operational Directive (BOD) 22-01, the KEV catalog answers the most important question in vulnerability management: which vulnerabilities are attackers actually using right now?
For a vulnerability to be added to the KEV catalog, it must meet three criteria:
This three-part standard is what makes KEV different from broader vulnerability databases. The NVD lists over 200,000 CVEs. Your scanner might flag hundreds of findings in your environment. The KEV catalog tells you which of those are confirmed weapons in active use.
The KEV catalog has grown significantly since its launch. According to Cyble, the catalog reached 1,484 entries by the end of 2025, a 20% increase from 1,239 at the end of 2024. CISA added 245 vulnerabilities during 2025, a 30% jump in the addition rate compared to the 185 added in 2024.
Another report found that nearly 900 KEV entries showed first evidence of exploitation during 2025, indicating an acceleration in the pace at which vulnerabilities are being weaponized.
CISA also flagged 24 of the 2025 additions as known to be exploited by ransomware groups, connecting the KEV catalog directly to the most financially damaging attack campaigns targeting organizations of all sizes.
While BOD 22-01 legally binds federal civilian agencies to remediate KEV entries within prescribed timeframes, the catalog's value extends far beyond government compliance.
Here's why startups should pay attention to the Known Exploited Vulnerabilities list:
For startups building a vulnerability management program, here's how to make the Known Exploited Vulnerabilities catalog actionable:
No. BOD 22-01, which mandates KEV remediation within specific timeframes, applies only to federal civilian executive branch (FCEB) agencies. But CISA explicitly recommends all organizations, public and private, use the KEV catalog as a prioritization resource. In practice, the KEV catalog has become a widely adopted benchmark across industries. Enterprise customers, compliance auditors, and cyber insurance providers increasingly reference KEV as an indicator of vulnerability management maturity, making it relevant for startups well beyond the federal government.
CISA adds new entries to the Known Exploited Vulnerabilities catalog on a rolling basis, typically multiple times per week. In 2025, CISA added 245 new entries over the course of the year. Each addition includes the CVE ID, vendor and product details, a description of the vulnerability, the required remediation action, and a due date for federal agencies. You can monitor updates through CISA's alerts page, the KEV JSON/CSV data feed, or security tools that integrate KEV data automatically.
The NVD is comprehensive: it catalogs virtually every published CVE (over 200,000) with CVSS severity scores, regardless of whether the vulnerability has ever been exploited. The KEV catalog is selective: it only includes vulnerabilities with confirmed active exploitation, clear remediation guidance, and an assigned CVE. Think of the NVD as the encyclopedia of all known vulnerabilities and the KEV as the short list of ones actually being used in attacks right now. Both are valuable, but for prioritization purposes, KEV status is a much stronger signal of immediate risk.
