How to patch a CISA KEV entry

Before you start #

• An asset inventory that records vendor, product and version
• The KEV entry’s CVE ID, required action, due date and notes
• An emergency-change path that doesn’t wait for the next patch window

Steps #

0 of 8 steps done

1. Mark step 1 done

   01 Confirm whether you run the affected product

   Match the entry’s vendor and product against your inventory, including cloud services and appliances. Record every affected asset.^[1]

2. Mark step 2 done

   02 Read the required action, due date and notes

   The entry says what CISA requires, usually applying the vendor’s update or mitigation or discontinuing the product, and links the vendor advisory.^[2]

3. Mark step 3 done

   03 Prioritize internet-facing assets

   Exposed systems are the ones attackers reach first. Fix those before internal ones.

4. Mark step 4 done

   04 Apply the update or the vendor’s mitigation

   If no patch exists yet, apply the documented mitigation. If neither is possible, take the asset offline or discontinue it, as the required action allows.^[1]

5. Mark step 5 done

   05 Check for signs of compromise

   The vulnerability is already being exploited, so patching may be too late. Some recent entries reference CISA forensic-triage requirements; follow them where they apply.^[4]

6. Mark step 6 done

   06 Verify the fix

   Confirm the running version or configuration on every affected asset, not only that a change ticket was closed.

7. Mark step 7 done

   07 Record completion against the due date

   Keep the date fixed, the assets covered and any exceptions. Federal civilian agencies must report under CISA’s directives; everyone else benefits from the same audit trail.^[3]

8. Mark step 8 done

   08 Automate the next one

   Pull CISA’s KEV JSON feed on a schedule and alert when a new entry matches your inventory.^[2]

Progress is saved in this browser only.

Done when #

Every affected asset is patched, mitigated or retired before the due date, compromise checks are recorded, and new KEV entries raise an alert automatically.

Evidence #

1. [1]Known Exploited Vulnerabilities CatalogCISA Primary
2. [2]Known Exploited Vulnerabilities catalog (JSON feed)CISA Primary
3. [3]BOD 22-01: Reducing the Significant Risk of Known Exploited VulnerabilitiesCISA, 2021-11-03 Primary
4. [4]BOD 26-04: Prioritizing Security Updates Based on RiskCISA Primary

Related questions #

Changelog #