Cleartext

Sample content: drafted with AI assistance from the cited sources and awaiting editorial verification. How verification works

Question Vulnerabilities

What is the CISA KEV catalog?

Verified by [VERIFIER NAME]Rev. 14 sources Data: CISA KEV 2026.09.23, rebuilt

Short answer

51 words

The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.

Source: https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/ (Cleartext, verified 2026-09-24)
MarkdownCite

What gets a vulnerability listed #

CISA adds a vulnerability to the catalog when it has an assigned CVE ID, there is reliable evidence it is being actively exploited, and there is clear remediation guidance, such as a vendor update.[1] That makes KEV much shorter than the full list of published vulnerabilities, and far more useful for deciding what to fix first.

What the due date means #

Binding Operational Directive 22-01, issued in November 2021, created the catalog and requires US federal civilian executive branch agencies to remediate listed vulnerabilities by their due dates.[2] In the current feed, 104 entries’ required-action text refers to a newer directive, BOD 26-04, Prioritizing Security Updates Based on Risk.[3] Check CISA’s directives page for which directive governs a given entry. More: what the KEV due date means.

What’s in it now #

As of catalog version 2026.09.23, released September 23, 2026, KEV lists 1,721 vulnerabilities from 283 vendors and projects; 361 are flagged as known to be used in ransomware campaigns.[4] Cleartext mirrors the latest entries as reference pages.

Evidence #

Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.

  1. [1]Known Exploited Vulnerabilities CatalogCISA Primary
  2. [2]BOD 22-01: Reducing the Significant Risk of Known Exploited VulnerabilitiesCISA, 2021-11-03 Primary
  3. [3]BOD 26-04: Prioritizing Security Updates Based on RiskCISA Primary
  4. [4]Known Exploited Vulnerabilities catalog (JSON feed)CISA Primary

What this means for you #

Banks & credit unions

Examiners and auditors increasingly ask how quickly KEV entries are remediated. Track time-to-patch for KEV-listed vulnerabilities separately from your general vulnerability backlog.

Fintechs & payment firms

If you can’t patch everything, patch what’s in KEV first. It is a short list of vulnerabilities attackers are known to be using, not a theoretical severity score.

Developers & identity teams

Pull the JSON feed into your dependency and asset tooling so a new KEV entry for something you run raises an alert, rather than waiting for a scanner run.

Follow-up questions #

Is KEV the same as the NVD?
No. NIST’s National Vulnerability Database describes all published CVEs. KEV is CISA’s much shorter list of those with evidence of exploitation.
Is KEV binding on private companies?
No. The due dates bind US federal civilian executive branch agencies. For everyone else the catalog is a prioritization input.

People also ask #

How many vulnerabilities are in the CISA KEV catalog?

CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.

Full answer
What does the due date in the CISA KEV catalog mean?

It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.

Full answer
Which vendors have the most CISA KEV entries?

Microsoft has the most entries in CISA’s Known Exploited Vulnerabilities catalog, with 388 of 1,721 (22.5%), followed by Cisco (99) and Apple (94), as of catalog 2026.09.23. A high count is not by itself a measure of how secure a vendor’s products are.

Full answer

Decide and act #

ComparisonTOTP vs push notificationsChecklistHow to patch a CISA KEV entry

Cite this answer #

Answers change. Include the verification date when you quote this page.

Plain text

Cleartext. “What is the CISA KEV catalog?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/

Markdown link

[What is the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/) (Cleartext, verified 2026-09-24)

Changelog #

DateRevisionChange
Rev. 1First published.
TopicsCISA KEV catalogCISA