Known Exploited Vulnerabilities, explained.

How a flaw gets into KEV

CISA adds a vulnerability when it meets three criteria:

1. It has a CVE IDAn assigned Common Vulnerabilities and Exposures identifier.
2. It is being exploitedReliable evidence that the vulnerability has been actively exploited in the wild.
3. There is a fixA clear remediation action, such as a vendor-provided update.

So KEV is not a list of every serious flaw. It is the much shorter list of flaws that attackers are known to be using and that you can do something about.

BOD 22-01, BOD 26-04 and the deadlines

BOD 22-01 (3 November 2021) required federal civilian agencies to fix KEV entries within two weeks, or six months for CVEs assigned before 2021. It is now revoked.

BOD 26-04, “Prioritizing Security Updates Based on Risk” (10 June 2026), sets each deadline from four factors: whether the asset is publicly exposed, whether the CVE is in KEV, whether the exploit can be automated, and whether the impact is total or partial. A KEV entry gets 3 days or 14 days; the most serious also require forensic triage. The directive binds federal civilian executive branch agencies; contractors are covered only where their contract says so. Older KEV entries still cite BOD 22-01 in their required action; newer ones cite BOD 26-04.

Using the files

The catalog is published as JSON and CSV, with a published schema. The JSON file carries a catalog version, a release date and a count, then one record per vulnerability:

• cveID, vendorProject, product and vulnerabilityName: what is affected.
• dateAdded and dueDate: when CISA added it and the federal deadline.
• shortDescription and requiredAction: what the flaw is and what to do.
• knownRansomwareCampaignUse: “Known” where CISA knows of ransomware use.
• forensicTriage: “Yes” where BOD 26-04 requires forensic triage. A new field in 2026.
• notes and cwes: references and weakness types.

A simple routine

1. Keep a list of what you runMaker, product and version for every system and device, including the ones nobody logs into: cameras, controllers, routers, appliances.
2. Match it against the catalogCompare your makers and products with vendorProject and product. The names are free text, so match loosely and confirm by CVE with your scanner or the vendor’s advisory.
3. Fix the matches firstFollow requiredAction. Treat entries marked for ransomware use or forensic triage as the most urgent, and use the federal due date as a benchmark even if it does not bind you.
4. Watch for additionsCISA offers email updates for KEV through its GovDelivery subscription; KEV additions also appear in CISA’s alerts RSS feed; and CISA mirrors the files in the cisagov/kev-data repository on GitHub.

Questions people ask

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog is CISA's list of vulnerabilities that have a CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action. It is published free as a web page, a JSON file and a CSV file, and held 1,739 entries in the release of 8 October 2026.

Is BOD 22-01 still in effect?

No. CISA issued BOD 26-04, Prioritizing Security Updates Based on Risk, on 10 June 2026. It revoked BOD 22-01 and BOD 19-02. The KEV catalog and its criteria carried over unchanged.

How long do federal agencies have to fix a KEV vulnerability?

Under BOD 26-04, a KEV entry must be fixed within 3 or 14 days, depending on whether the asset is publicly exposed, whether the exploit can be automated and whether the impact is total or partial; the most serious also require forensic triage. Under the revoked BOD 22-01 the deadlines were two weeks, or six months for CVEs assigned before 2021.

Does KEV apply to private companies?

The directives bind federal civilian executive branch agencies, and contractors only where their contract says so. CISA recommends that all organisations use the KEV catalog as an input to their vulnerability management prioritisation.

How do I download the KEV catalog?

CISA publishes it as JSON at cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json and as CSV at cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv, with a JSON schema, and mirrors the files in the cisagov/kev-data repository on GitHub.

Primary sources

• CISA, Known Exploited Vulnerabilities Catalog, catalog version 2026.10.08, released 8 October 2026.
• CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities (the KEV criteria), read 12 October 2026.
• CISA, BOD 26-04, Prioritizing Security Updates Based on Risk, 10 June 2026.
• CISA, BOD 22-01 (revoked), issued 3 November 2021.
• cisagov/kev-data, CISA’s mirror of the KEV files, last updated 8 October 2026.

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency or maker named here.

← All guides and checks