thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Known Exploited Vulnerabilities Catalog (KEV)

CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.

Definition

Binding Operational Directive 22-01 requires US federal civilian agencies to remediate KEV entries within set deadlines. Each entry includes the CVE, required action and due date. Private organizations widely use KEV as a high-priority patching signal.

Example

A vulnerability management team auto-escalates any asset with a CVE that appears in the CISA KEV catalog.

Exam tip

KEV is about confirmed exploitation; EPSS is about predicted exploitation.

Related terms