Skip to content
IntechPulse
Cybersecurity

CISA's KEV Catalog: How to Use It to Decide What to Patch First

CISA's Known Exploited Vulnerabilities catalog lists flaws attackers are already using. What qualifies, what the new BOD 26-04 changes, and how small IT teams can use it.

Written by: Published Editorial Policy · Corrections2 min read
A stack of hexagonal glass tiles with a few glowing red tiles lifted above the rest
Credit: AI-generated illustration
In this article
  1. What gets into KEV
  2. What BOD 26-04 changes
  3. How a small team can use it
  4. A weekly routine
  5. Automate where you can
  6. Our take

Most organizations can't patch everything at once, and the number of published vulnerabilities keeps growing. CISA's Known Exploited Vulnerabilities (KEV) catalog narrows the list to a practical question: which of these are attackers actually using? CISA calls the catalog "the authoritative source of vulnerabilities that have been exploited in the wild."

What gets into KEV

CISA lists three criteria. A vulnerability must:

  1. have an assigned CVE ID;
  2. have reliable evidence of active exploitation in the wild; and
  3. have a clear remediation action, such as a vendor update.

Each entry includes the affected product, a short description, the required action and links to vendor guidance. It also has a field showing whether the flaw is known to be used in ransomware campaigns. CISA publishes the catalog in machine-readable formats as well as on the web.

What BOD 26-04 changes

On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." According to CISA, it carries forward the KEV criteria from the earlier BOD 22-01 and brings KEV together with other decision points for patching timelines. Federal civilian agencies must fix KEV-listed flaws within set timeframes. Everyone else isn't bound by the directive, but CISA says all organizations can significantly strengthen their security by prioritizing KEV vulnerabilities.

How a small team can use it

A weekly routine

  • Compare your software and device inventory with new KEV entries every week, or subscribe to updates.
  • Patch internet-facing systems that appear in KEV first, starting with entries flagged for ransomware use.
  • If no patch can be applied quickly, follow the entry's mitigation guidance or take the system offline.

Automate where you can

CISA recommends vulnerability and patch management tools that automatically flag KEV entries, and points to the Stakeholder-Specific Vulnerability Categorization (SSVC) model as one framework that takes exploitation status into account.

Our take

KEV isn't a complete patch list; flaws that haven't been seen exploited yet still matter. But for a small team with limited time, "Is it in KEV, and is it exposed to the internet?" is a defensible first filter.

More: Cybersecurity coverage.

Sources

  1. Reducing the Significant Risk of Known Exploited Vulnerabilities — CISA · Primary source · accessed October 16, 2026Supports: BOD 26-04 (June 10, 2026), KEV criteria, guidance for non-federal organizations, SSVC, automation
  2. Known Exploited Vulnerabilities Catalog — CISA · Primary source · accessed October 16, 2026Supports: Catalog purpose, entry fields including ransomware-use flag, formats
Share:XLinkedInFacebookEmail

About the author

IntechPulse Newsroom

Newsroom

IntechPulse Newsroom articles are drafted with AI assistance from the cited public sources and pass automated checks for sourcing and originality before publication. Unless an article shows a "Reviewed by" credit, it was not individually reviewed by a human editor. Corrections follow our Corrections Policy.

Related reading