Secure Hyperloop

EXPLOITATION SIGNALS / RESEARCH GUIDE

CISA KEV: what “known exploited” really means.

The Known Exploited Vulnerabilities catalog is one of the clearest public signals that a specific software vulnerability has been exploited in the wild. Here's how to use it responsibly alongside other security information.

Explore known-exploited CVEs

What is the CISA KEV catalog?

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains the Known Exploited Vulnerabilities catalog to help defenders identify software flaws with known exploitation evidence. Entries typically include a CVE ID, vendor, product, vulnerability description, date added and recommended action.

A KEV listing is meaningful because it relates to observed exploitation, rather than severity estimates alone. It does not automatically describe how exposed your particular systems are.

Is KEV the same as CVSS?

No. CVSS is a framework for expressing technical vulnerability severity; KEV is a curated list of vulnerabilities with evidence of exploitation in the wild. A KEV entry can carry different CVSS scores depending on its underlying advisory, and a high-scoring CVE may not be listed in KEV.

These signals answer different questions: How severe could the flaw be? and Is there evidence of real-world exploitation? Neither replaces asset inventory, exposure assessment or remediation planning.

How to prioritize known exploited vulnerabilities

  1. Identify whether the affected product and vulnerable version exist in your environment.
  2. Determine whether vulnerable services are internet-accessible or otherwise exposed.
  3. Read CISA's required-action information and the vendor's current advisory.
  4. Apply tested vendor updates or mitigations where feasible; document exceptions.
  5. Verify remediation and monitor vendor updates if patches are unavailable.

CISA issues binding operational directives for certain US federal agencies; other organizations can use KEV as a strong prioritization input without assuming the same legal requirements apply to them.

Understanding the Secure Hyperloop view

The Research Hub combines CISA KEV data with recent GitHub advisories. Its KEV indicator means that the displayed CVE ID matches the currently loaded KEV catalog. If an advisory is not matched, the dashboard labels it “Not in KEV,” which is not an assurance of safety.

Public feeds may occasionally be unreachable. The website shows connection status and provides links to original information so you can verify time-sensitive findings.