KEV is a filter, not a to-do list
CISA's Known Exploited Vulnerabilities catalogue is the best triage input most teams have, and the most commonly misused. A note on what it does and does not tell you.
I built a small tool that checks CVEs against CISA’s Known Exploited Vulnerabilities catalogue. The most useful thing I learned building it was not technical.
What KEV actually is
The KEV catalogue is a list of vulnerabilities CISA has evidence are being exploited in the wild. It is deliberately conservative — a CVE lands there when there is reliable evidence of active exploitation, not when someone publishes a proof of concept and not when a scanner flags it as critical.
That conservatism is the whole value. It is a small, high-signal list in a field drowning in low-signal ones. The catalogue holds a few thousand entries against a CVE corpus in the hundreds of thousands.
The two failure modes
Treating it as a to-do list. A CVE in KEV that affects a product you do not run, or a component you do not expose, or a version you are not on, is not your problem. KEV says “someone is exploiting this somewhere”. It does not say “you are exposed”. Teams that patch straight down the KEV list burn effort on things that were never reachable in their estate.
Treating absence as safety. The inverse error, and the more dangerous one. A CVE not in KEV has not been cleared — it has not been observed being exploited, which for a vulnerability disclosed last week means almost nothing. KEV lags reality by design. A CVSS 9.8 in an internet-facing service with a public exploit is urgent whether or not CISA has catalogued it yet.
What it is good for
KEV works as one input to a prioritisation function, not as the function itself. The question is not “is this in KEV” but “does this reach anything of mine, and is someone using it”. Something like:
priority = exposure × exploitability × asset_criticalitywhere KEV membership is strong evidence in the exploitability term, exposure comes from
your own attack surface, and asset criticality comes from a conversation with the business
that most organisations have never actually had.
KEV supplies exactly one of those three, and it is the only one nobody else can give you. The other two are your homework.
Why I built a checker anyway
Because the lookup itself should be free and instant. Paste a list of CVEs, find out which ones CISA has seen exploited, and get on with the part that requires judgement. The tool does not tell you what to patch. It tells you which rows to read first.