CVE vs KEV: All Known Vulnerabilities vs Those Being Exploited
A CVE is an identifier for a publicly disclosed vulnerability, assigned whether or not anyone has exploited it. KEV refers to CISA's Known Exploited Vulnerabilities catalog, which lists CVEs with reliable evidence of active exploitation and clear remediation guidance. CVEs tell you what exists; KEV tells you which ones attackers are using, which makes it a strong prioritisation signal.
What each one is
CVE. The Common Vulnerabilities and Exposures programme assigns identifiers such as CVE-YYYY-NNNNN to publicly disclosed vulnerabilities, so that vendors, scanners, and defenders can refer to the same issue. A CVE says nothing about whether the vulnerability is being exploited or how severe it is; severity is usually expressed separately, for example with a CVSS score.
KEV. The Known Exploited Vulnerabilities catalog is maintained by the US Cybersecurity and Infrastructure Security Agency. A vulnerability is added when it has an assigned CVE, there is reliable evidence of active exploitation, and there is clear remediation guidance, such as a vendor update. Under Binding Operational Directive 22-01, US federal civilian executive branch agencies must remediate catalogued vulnerabilities by specified due dates.
Why KEV matters for prioritisation
Tens of thousands of CVEs are published each year, and severity scores alone rank far too many of them as urgent. Most published vulnerabilities are never observed being exploited. KEV narrows attention to vulnerabilities attackers are known to be using, which is the most direct evidence of risk available.
KEV is not complete. Exploitation can happen before it is observed and catalogued, and the catalog focuses on vulnerabilities with actionable remediation. Treat KEV membership as a strong signal to act fast, not as the only reason to act.
Using both in practice
A practical prioritisation combines several inputs: whether the vulnerability is in KEV or otherwise known to be exploited, whether the affected system is exposed to the internet, how critical the asset is, and severity. An internet-facing system with a KEV-listed vulnerability should be near the top of any queue. Automate the KEV check in your vulnerability tooling so new catalog entries are matched against your inventory as soon as they appear.
What KEV does not tell you
KEV does not say whether a vulnerability affects your configuration, whether a mitigating control already blocks it, or how exposed the affected system is in your environment. Those answers come from your inventory, your network design, and your own testing. A KEV-listed vulnerability on an isolated internal system with no path from untrusted networks may be less urgent than an unlisted but actively discussed flaw on an internet-facing service. Use KEV to focus attention, then apply judgement.
| Aspect | CVE | KEV |
|---|---|---|
| What it is | Identifier for a disclosed vulnerability | Catalog of vulnerabilities known to be exploited |
| Maintained by | CVE Program and its numbering authorities | CISA |
| Inclusion | Public disclosure of a vulnerability | CVE ID, evidence of active exploitation, clear remediation |
| Volume | Very large | Small subset of CVEs |
| Main use | Common naming and tracking | Prioritising remediation |
| Mandatory for | Not applicable | US federal civilian agencies under BOD 22-01 |
Frequently asked questions
- Is every CVE in the KEV catalog?
- No. KEV includes only CVEs with reliable evidence of active exploitation and clear remediation guidance, which is a small fraction of all published CVEs. A vulnerability not in KEV may still be exploited, since exploitation can occur before it is observed and catalogued.
- Do private companies have to follow KEV deadlines?
- The deadlines in CISA's Binding Operational Directive 22-01 apply to US federal civilian executive branch agencies. Private organisations are not bound by them, but CISA encourages everyone to use the catalog to prioritise remediation, and many security teams treat KEV entries on exposed systems as urgent.
- How should KEV be used in vulnerability management?
- Match new KEV entries against your asset inventory automatically, and prioritise remediation of listed vulnerabilities on internet-facing and critical systems first. Combine KEV status with exposure, asset criticality, and severity rather than relying on any single score, and track time to remediate KEV-listed vulnerabilities as a key metric.
- How quickly is a vulnerability added to KEV?
- It depends on when reliable evidence of exploitation emerges and is confirmed, and on remediation guidance being available. Some vulnerabilities are added soon after disclosure; others are added long after publication when exploitation is observed. Organisations should not wait for KEV listing before patching internet-facing systems against serious, well-publicised flaws.