# How to patch a CISA KEV entry

> **In brief:** A repeatable process for handling a vulnerability CISA has added to the Known Exploited Vulnerabilities catalog: confirm exposure, read the required action, patch or mitigate, check for compromise, and record completion before the due date.

- URL: https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

- For: Security and IT operations teams
- Time: Within the entry’s due date; start the day it is listed.

## Before you start

- An asset inventory that records vendor, product and version
- The KEV entry’s CVE ID, required action, due date and notes
- An emergency-change path that doesn’t wait for the next patch window

## Steps

1. [ ] **Confirm whether you run the affected product.** Match the entry’s vendor and product against your inventory, including cloud services and appliances. Record every affected asset.[^1]
2. [ ] **Read the required action, due date and notes.** The entry says what CISA requires, usually applying the vendor’s update or mitigation or discontinuing the product, and links the vendor advisory.[^2]
3. [ ] **Prioritize internet-facing assets.** Exposed systems are the ones attackers reach first. Fix those before internal ones.
4. [ ] **Apply the update or the vendor’s mitigation.** If no patch exists yet, apply the documented mitigation. If neither is possible, take the asset offline or discontinue it, as the required action allows.[^1]
5. [ ] **Check for signs of compromise.** The vulnerability is already being exploited, so patching may be too late. Some recent entries reference CISA forensic-triage requirements; follow them where they apply.[^4]
6. [ ] **Verify the fix.** Confirm the running version or configuration on every affected asset, not only that a change ticket was closed.
7. [ ] **Record completion against the due date.** Keep the date fixed, the assets covered and any exceptions. Federal civilian agencies must report under CISA’s directives; everyone else benefits from the same audit trail.[^3]
8. [ ] **Automate the next one.** Pull CISA’s KEV JSON feed on a schedule and alert when a new entry matches your inventory.[^2]

## Done when

Every affected asset is patched, mitigated or retired before the due date, compromise checks are recorded, and new KEV entries raise an alert automatically.

## Sources

[^1]: Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[^2]: Known Exploited Vulnerabilities catalog (JSON feed). CISA. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[^3]: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. CISA, 2021-11-03. https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
[^4]: BOD 26-04: Prioritizing Security Updates Based on Risk. CISA. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

## Related questions

- [What is the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/)
- [What does the due date in the CISA KEV catalog mean?](https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/)

## Cite

Cleartext. “How to patch a CISA KEV entry” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/

## Changelog

- 2026-09-24: First published.