KEV stands for Known Exploited Vulnerability.
The Known Exploited Vulnerabilities (KEV) Catalog is maintained by CISA (the U.S. Cybersecurity and Infrastructure Security Agency). Its purpose is to help organizations prioritize vulnerabilities that are actively being exploited in the wild and therefore pose an immediate and critical risk.
Unlike theoretical or low-risk vulnerabilities, KEVs are confirmed to be used by threat actors and should be treated as urgent remediation items.
How does CISA decide what’s included in the KEV catalog?
CISA applies strict criteria before adding a vulnerability to the KEV catalog:
✅ Assigned CVE ID
The vulnerability must have an official CVE ID.
✅ Active exploitation
There must be evidence that the vulnerability:
Has already been exploited, or
Is currently under active exploitation by threat actors
This means malicious code is being used to take advantage of the vulnerability in real-world attacks.
✅ Clear remediation guidance
CISA only adds vulnerabilities when there is a clear and actionable remediation path, such as applying a patch or configuration change.
What should you do if a KEV is detected?
According to CISA guidance, systems affected by KEVs should be patched as soon as possible.
Delaying remediation significantly increases the risk of compromise.
How does Panorays support KEVs?
Panorays helps you identify, prioritize, and respond to KEVs across your organization and supply chain in two key ways:
🔍 Risk Insights
Panorays generates a Risk Insight event when a company or supplier is exposed to a KEV, based on its CVE ID.
This highlights immediate exposure to vulnerabilities that are actively exploited in the wild.
🚨 Critical finding
We’ve added a dedicated finding under the Technology category:
Panorays detects technologies in use
Matches them against known CVEs
If a CVE appears in CISA’s KEV catalog, the finding is automatically prioritized as Critical
This ensures KEVs stand out clearly and receive the urgency they require.
KEVs are not theoretical risks—they represent real, ongoing attacks. Panorays makes sure they’re visible, prioritized, and actionable so you can respond fast and reduce exposure.