Of all known vulnerabilities, only some are actually attacked. The Cybersecurity and Infrastructure Security Agency (CISA) collects exactly these vulnerabilities in the KEV catalog. It was established for US federal agencies with directive BOD 22-01 of November 3, 2021. Since June 10, 2026, the new directive BOD 26-04 applies there and replaces BOD 22-01. The catalog remains central to it. CISA recommends that all organizations, including those outside government, remediate KEV vulnerabilities immediately.
When is a vulnerability added to the KEV catalog?
CISA only adds a vulnerability if three conditions are met:
- It has a CVE identifier.
- There is reliable evidence that it is being actively exploited.
- There is clear remediation guidance, such as a vendor update or a workaround.
Each entry lists the vendor, product, date added, the required action and whether the vulnerability is known to have been used in ransomware campaigns. The catalog is available as a web page and as CSV and JSON files, so tools can match against it automatically. On October 25, 2026, it contained 1,756 entries.
What BOD 26-04 changes
US federal agencies previously had fixed deadlines: two weeks for vulnerabilities with CVE identifiers from 2021 onward, six months for older ones. BOD 26-04 replaces this with deadlines based on internet exposure, KEV status, automatability and technical impact. If a forensic review is also required, the vulnerability must be remediated or mitigated within three days. These deadlines are not binding for companies in Austria, but they show how seriously the agency takes exploited vulnerabilities.
In practice for SMEs and municipalities
- Match instead of reading: Many scanners and patch tools flag KEV vulnerabilities automatically. Check whether your tool or your IT service provider does this.
- Define an immediate-action rule: A KEV vulnerability on a system reachable from the internet, such as a firewall, VPN, email server or web portal, does not belong in the next monthly cycle but in an emergency update. The basis for this is well-practiced patch management.
- Check after the update: Was the vulnerability exploited before it was closed? Indications are often found in the vendor advisory or in warnings from CERT.at.
Limitations
- Not a complete picture: The catalog only contains vulnerabilities for which CISA has solid evidence. If a vulnerability is missing, it is not automatically harmless.
- US perspective: Products that are mainly widespread in Europe may be underrepresented. As a supplement, ENISA's EU database EUVD shows an overview of exploited vulnerabilities.
- Time lag: Days can pass between first exploitation and inclusion. For the early phase, the probability estimate EPSS helps.
How TOMORIS relates
GRID.patch combines maintenance windows, staged updates and monitoring into a traceable process. GRID.scout makes affected systems visible.