TL;DR

CISA’s Known Exploited Vulnerabilities (KEV) catalog is the single best public signal for what’s actually being exploited right now. A KEV entry beats a CVSS 10 on an unused internal service every time. But most teams just scan it monthly and pray. This post covers a repeatable workflow: match KEV entries against your asset inventory, score by CISA’s due date, and remediate before the clock runs out.

What KEV Is (and Isn’t)

KEV is a curated list of vulnerabilities that CISA has confirmed are actively exploited in the wild. Unlike the NVD feed (thousands of CVEs per week), KEV entries go through a verification process:

  • Confirmed exploitation: Attackers are using this now, not just a PoC on GitHub.
  • Vendor patch available: There’s a fix, or a documented workaround.
  • Impact documented: The catalog entry includes the product, vulnerability name, and due date for remediation.

CISA issues BOD-mandated due dates (typically 28–42 days from publication) for federal agencies. For private sector, the due date is a strong signal but not a mandate.

What KEV is NOT:

  • A prioritization tool by itself. It tells you what is exploited, not how it impacts your specific assets.
  • A substitute for vulnerability scanning. KEV is reactive — it adds entries after exploitation is confirmed.
  • A comprehensive list. It covers a fraction of CVEs per quarter because CISA only adds what it can confirm.

The Problem With How Teams Use KEV

Most teams do one of two things:

  1. Bookmark and forget: They open the catalog once and never look again until an incident reminds them.
  2. Flat-scan: They run the whole list against their asset inventory and patch everything in CVSS order.

Both miss the point. KEV’s value is in its temporal dimension — the due date. A KEV entry with a due date next week is more urgent than one expiring in three months, regardless of CVSS score.

A Repeatable KEV Workflow

Step 1: Inventory matching

You already have a software inventory. If you don’t, start with:

# Example: find all GitLab installations on the network
nmap --script http-headers -p 80,443,8080 10.0.0.0/16 | grep -i gitlab

Map each running service to its version. Version matching is where most teams fail — a CVE affecting “GitLab CE/EE 16.0–16.9” means nothing if you’re on 17.1.

Step 2: Fetch and parse KEV

The KEV catalog is a JSON file CISA publishes at:

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

It contains ~500 entries as of mid-2026. Each entry has:

  • cveID — the CVE number
  • vendorProject — vendor name (e.g., “Microsoft”, “JetBrains”)
  • product — product name (e.g., “SharePoint Server”, “TeamCity”)
  • vulnerabilityName — human-readable description
  • dateAdded — when CISA added the entry
  • dueDate — remediation deadline
  • shortDescription — what the exploit does
  • notes — additional context

Step 3: Score by urgency

Not all KEV entries are equal urgency. Use this scoring:

Factor Weight How
Days until CISA due date 40% Urgency increases exponentially as due date approaches
Asset criticality 25% Production internet-facing = high, internal = medium
Exploit maturity 20% Ransomware exploit > PoC > vendor confirmation
CVSS base score 15% Still matters for impact assessment

A practical implementation:

from datetime import datetime, timedelta

def kev_priority(cve_entry, asset, cvss_score):
    """Score a KEV entry against a specific asset."""
    due = datetime.strptime(cve_entry["dueDate"], "%Y-%m-%d")
    now = datetime.utcnow()
    days_left = (due - now).days
    
    # Urgency increases as due date approaches
    if days_left <= 7:
        due_score = 100
    elif days_left <= 14:
        due_score = 80
    elif days_left <= 30:
        due_score = 50
    else:
        due_score = 20
    
    # Asset criticality multiplier
    asset_mult = {
        "critical": 1.0,
        "high": 0.85,
        "medium": 0.65,
        "low": 0.4
    }
    
    priority = (
        due_score * 0.4 +
        cvss_score * 10 * 0.15 +  # CVSS 10.0 → 100
        asset_mult.get(asset["criticality"], 0.65) * 25 +
        (80 if asset["exploit_maturity"] == "ransomware" else 50) * 0.2
    )
    
    return round(priority, 1)

Step 4: Remediate before the date

The CISA due date is when the agency needs to patch. For private sector, aim for half the due date as your internal target. If CISA says patch by August 30, you should patch by August 16.

Track remediation progress:

Status Meaning
Confirmed KEV entry matches a live asset
In progress Patch tested or workaround deployed
Remediated Fix applied to production
Accepted Risk accepted (asset decommissioned or isolated)
False positive Asset version not in affected range

Real Example: CVE-2026-63077 (TeamCity)

CISA added this to KEV on 2026-07-15 with a due date of 2026-08-08 (past the federal deadline, but still active). It’s a deserialization flaw in TeamCity’s REST API that allows unauthenticated RCE. Known exploited by ransomware groups.

Why it matters for Trinity: The host oscar runs GitLab, which uses TeamCity as its CI backend. If that TeamCity instance is on an affected version, it’s a confirmed exploitation target.

Workflow:

  1. Check TeamCity version on the build server
  2. If affected → patch or isolate from the internet
  3. Verify the fix resolves the deserialization vector
  4. Log the remediation and close the KEV tracking item

What to Do When KEV Doesn’t Have Your CVE

KEV adds ~50 entries per quarter. Most exploited vulnerabilities never make the list because CISA can’t confirm exploitation independently. For those:

  • Rely on your vulnerability scanner (Nessus, OpenVAS, Trivy) for broader coverage.
  • Watch vendor advisories for your specific stack.
  • Track EPSS scores — high EPSS (>0.7) means high probability of exploitation even without KEV confirmation.
  • Use threat intel feeds (MISP, AlienVault OTX) for sector-specific signals.

KEV is one signal in a stack, not the whole picture.

KEV as a Triage Shortcut

The real power of KEV is in triage. When you have 500 open CVEs and 4 hours, KEV tells you which 5 to fix first. It answers the question every security team faces: “What should I patch before I go home?”

The answer is rarely “the CVSS 9.8.” It’s “the one CISA says is being exploited this week that touches our production internet-facing assets.”

Conclusion

KEV is a prioritization tool disguised as a list. The catalog itself is simple JSON with a few fields. Its value comes from:

  1. Timely inventory matching — run it against your asset list weekly, not quarterly.
  2. Due-date urgency — prioritize entries closest to their deadline.
  3. Remediation tracking — confirm, in progress, fixed, accepted.
  4. Integration with other signals — EPSS, vendor advisories, threat intel.

Bookmark the catalog. Feed it into your triage pipeline. Patch before the date. Repeat.

Further Reading