# What is the CISA KEV catalog?

> **Short answer:** The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.

- URL: https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)
- Data: computed from CISA KEV catalog 2026.09.23 at build time (2026-10-20)

## What gets a vulnerability listed

CISA adds a vulnerability to the catalog when it has an assigned CVE ID, there is reliable evidence it is being actively exploited, and there is clear remediation guidance, such as a vendor update.[^1] That makes KEV much shorter than the full list of published vulnerabilities, and far more useful for deciding what to fix first.

## What the due date means

Binding Operational Directive 22-01, issued in November 2021, created the catalog and requires US federal civilian executive branch agencies to remediate listed vulnerabilities by their due dates.[^2] In the current feed, 104 entries’ required-action text refers to a newer directive, BOD 26-04, *Prioritizing Security Updates Based on Risk*.[^3] Check CISA’s directives page for which directive governs a given entry. More: [what the KEV due date means](https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/).

## What’s in it now

As of catalog version 2026.09.23, released September 23, 2026, KEV lists 1,721 vulnerabilities from 283 vendors and projects; 361 are flagged as known to be used in ransomware campaigns.[^4] Cleartext mirrors the latest entries as [reference pages](https://glide-cleartext.pages.dev/cve/).

## What this means for you

### Banks & credit unions

Examiners and auditors increasingly ask how quickly KEV entries are remediated. Track time-to-patch for KEV-listed vulnerabilities separately from your general vulnerability backlog.

### Fintechs & payment firms

If you can’t patch everything, patch what’s in KEV first. It is a short list of vulnerabilities attackers are known to be using, not a theoretical severity score.

### Developers & identity teams

Pull the JSON feed into your dependency and asset tooling so a new KEV entry for something you run raises an alert, rather than waiting for a scanner run.

## Follow-up questions

**Is KEV the same as the NVD?**

No. NIST’s National Vulnerability Database describes all published CVEs. KEV is CISA’s much shorter list of those with evidence of exploitation.

**Is KEV binding on private companies?**

No. The due dates bind US federal civilian executive branch agencies. For everyone else the catalog is a prioritization input.


## Sources

[^1]: Known Exploited Vulnerabilities Catalog. CISA. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[^2]: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. CISA, 2021-11-03. https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
[^3]: BOD 26-04: Prioritizing Security Updates Based on Risk. CISA. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
[^4]: Known Exploited Vulnerabilities catalog (JSON feed). CISA. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

## Related questions

- [How many vulnerabilities are in the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/)
- [What does the due date in the CISA KEV catalog mean?](https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/)
- [Which vendors have the most CISA KEV entries?](https://glide-cleartext.pages.dev/q/which-vendors-have-the-most-cisa-kev-entries/)

## Cite

Cleartext. “What is the CISA KEV catalog?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/

## Changelog

- 2026-09-24: First published.