KEV Vulnerabilities | JEAA Infosec

// Understanding KEV

WHAT IS THE KEV CATALOG?

CISA (Cybersecurity and Infrastructure Security Agency) maintains the Known Exploited Vulnerabilities (KEV) catalog — an authoritative source of vulnerabilities that have been confirmed as actively exploited in real-world attacks. Unlike theoretical vulnerabilities or those with proof-of-concept exploits, every entry in KEV has evidence of actual malicious use.

For Federal Civilian Executive Branch (FCEB) agencies, Binding Operational Directive (BOD) 22-01 requires remediation of KEV vulnerabilities within prescribed timeframes. But the guidance is clear for everyone: if it's on the KEV list, it should be at the top of your patch priority.

Why This Matters

The KEV catalog isn't about theoretical risk — it's about confirmed, active exploitation. When a CVE gets added to KEV, threat actors are already using it against real targets. The window between KEV addition and widespread automated scanning is shrinking.

1200+

Total KEV Entries

~10

New CVEs Weekly

21 Days

Typical Deadline

// Recent Additions

NOTABLE RECENT KEV ENTRIES

These vulnerabilities were recently added to the KEV catalog based on confirmed active exploitation. Verify exposure and prioritize remediation.

CVE ID	Vendor / Product	Vulnerability	Severity	Added
CVE-2025-55182	Meta React Server Components	Remote Code Execution via payload decoding flaw	Critical	Dec 2025
CVE-2025-62215	Microsoft Windows Kernel	Race condition privilege escalation to SYSTEM	Critical	Dec 2025
CVE-2025-9242	WatchGuard Firewalls	Authentication bypass in management interface	Critical	Dec 2025
CVE-2025-41244	Broadcom VMware Aria Operations	Privilege escalation from VM user to root	High	Dec 2025
CVE-2025-24893	XWiki XWiki Platform	Remote code execution via template injection	Critical	Dec 2025
CVE-2025-54309	CrushFTP File Transfer Server	Authentication bypass via alternate channel	Critical	Nov 2025

Stay Current

The KEV catalog is updated frequently — sometimes multiple times per week. Subscribe to CISA alerts or use automated vulnerability management tools to stay informed.

// Practical Application

HOW TO USE THE KEV CATALOG

The KEV catalog should be a core input to your vulnerability management prioritization. Here's how organizations should integrate it:

PRIORITIZE REMEDIATION

KEV vulnerabilities should jump to the front of your patch queue. Active exploitation means attackers have working exploits.

ASSET INVENTORY MATTERS

You can't patch what you don't know about. Maintain accurate asset inventories to quickly identify exposure when new KEVs drop.

AUTOMATE MONITORING

Manual tracking doesn't scale. Integrate KEV feeds into your vulnerability scanners and SIEM for immediate visibility.

TEST YOUR CONTROLS

Penetration testing should include attempts to exploit KEV vulnerabilities. Validate that your patches are actually effective.

// How We Help

KEV-INFORMED PENETRATION TESTING

JEAA Infosec integrates KEV awareness into every engagement. We don't just run scanners — we actively test for exploitability of known threats relevant to your environment.

Active exploitation validation — We test whether KEV vulnerabilities in your environment are actually exploitable, not just "present" according to version detection.
Compensating control assessment — Can't patch immediately? We assess whether your compensating controls actually prevent exploitation.
Attack chain analysis — How do KEV vulnerabilities fit into broader attack paths? We map exploitation scenarios specific to your infrastructure.
Prioritized remediation guidance — Clear, actionable recommendations based on actual risk to your organization.

📋

CISA KEV Catalog

Official catalog with full vulnerability list and remediation deadlines

→ 📖

BOD 22-01 Guidance

CISA's binding directive on KEV remediation requirements

→

CISA KNOWN EXPLOITED VULNERABILITIES