Patch prioritization with CISA KEV: a practical guide
Thousands of new vulnerabilities are published every month. Nobody can patch them all at once, so the real question isn't "how severe is it?" but "is it being exploited against organizations like ours right now?"
What KEV is
CISA's Known Exploited Vulnerabilities catalog only lists vulnerabilities with evidence of active exploitation, an assigned CVE, and clear remediation guidance. US federal agencies must remediate them by a due date. For everyone else, it's an excellent free priority list.
A workflow that works
- Match KEV against your asset inventory. Without an accurate inventory of systems and versions, you can't know whether you're exposed.
- Set SLAs by exposure. For example, KEV entries on internet-facing systems within days, and internal systems within two weeks.
- Escalate ransomware-linked entries. Vulnerabilities known to be used in ransomware campaigns get immediate attention.
- No patch? Reduce exposure. Remove internet access, disable the feature or add a WAF rule, and document the risk.
- Measure. Report mean time to remediate KEV entries and the open count to leadership.
KEV, CVSS and EPSS
- CVSS measures theoretical severity.
- EPSS estimates the probability of exploitation in the near term.
- KEV tells you it's already being exploited.
A common order: KEV first, then high EPSS, then CVSS.
See the live list: vulnerabilities exploited right now