Blog · 2026-10-27 · Gardience Engineering

CISA KEV list: what it means for your servers

CISA's Known Exploited Vulnerabilities catalog is the short list of CVEs attackers are actually using. What it is, the new 3-day deadlines under BOD 26-04, whether it applies to you, and a script that checks any scan export against it.

Our test lab has 8 machines. Its daily CVE check lists 212 different CVEs on them, 834 machine-and-CVE pairs in all. That looks like a lot of work.

Then we checked those 212 against CISA's Known Exploited Vulnerabilities list. None of them are on it. Not one of the CVEs in our lab is something CISA has seen attackers use.

That is the whole point of the list. A vulnerability scanner tells you everything that could be a problem. KEV tells you what is being used against people right now. If you only have time to fix a few things this week, KEV is how you pick them.

What the KEV list is#

CISA (the US Cybersecurity and Infrastructure Security Agency) keeps a catalog of vulnerabilities that have reliable evidence of being exploited in the wild. To be added, a vulnerability needs a CVE number, evidence of real attacks, and a clear fix or mitigation.

As of October 26, 2026:

• 1,758 entries in total, 274 of them added in 2026 and 32 in the last 30 days.
• Microsoft has the most (390), then Cisco (101), Apple (95), Adobe (82), and Google (75).
• 361 are known to be used in ransomware campaigns.

Three from this month that you have probably heard about:

Every one of them had three days.

The deadlines just got much shorter#

For years the rule was BOD 22-01, a CISA directive that gave federal agencies two to three weeks to fix most new KEV entries.

On June 10, 2026, CISA replaced it with BOD 26-04, "Prioritizing Security Updates Based on Risk." Deadlines now run from three days to "fix it at the next system upgrade," decided by four questions:

1. Is the CVE in the KEV list?
2. Is the vulnerable machine reachable from the internet?
3. Can an attacker automate the whole attack?
4. Does it give the attacker partial or total control?

The most urgent tier is three days, plus forensic triage: you fix it and you check whether the machine was already broken into. Fixing a server that already has a web shell on it does not remove the web shell.

You can see the change in the list itself. Since June 10, CISA has added 141 entries: 115 with a three-day deadline and 26 with fourteen days. 93 of them carry the forensic triage flag. Earlier in 2026, most entries got two or three weeks.

The deadlines also move. Taking a machine off the internet can buy you more time; a new KEV entry can take time away.

Does it apply to me?#

Legally, probably not. BOD 26-04 binds federal civilian agencies. Contractors are covered only if their contract says so, though CISA tells agencies to review their contracts, so expect it to show up there. CISA also says it "strongly encourages all partners" to adopt the same approach.

Practically, yes. Attackers do not check whether you are a federal agency. If something is on the KEV list, someone is using it, and three days is roughly how long you have before it is used on you.

If you are a defense contractor, NIST SP 800-171 requirement 3.14.1 (part of CMMC Level 2) says to identify, report, and correct system flaws "in a timely manner," without saying how timely. Fixing KEV entries on CISA's own deadlines and keeping the record is a clear, defensible answer when an assessor asks what "timely" means for you.

How to use it#

1. Know when something is added#

CISA publishes the list as a web page, a CSV, and a JSON feed, and you can sign up for its email alerts. The JSON feed is the one to automate against:

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Each entry has the CVE, vendor and product, the date added, the due date, the required action, whether it is known to be used in ransomware, and whether forensic triage is called for.

2. Check your scan results against it#

Any vulnerability scanner can export a CSV. This short Python script reads one, pulls the current KEV feed, and lists every machine and CVE that is on it, most urgent first:

#!/usr/bin/env python3
"""kev_check.py scan.csv: list the rows of a vulnerability export whose CVE is in CISA's KEV catalog, most urgent first."""
import csv, json, re, sys, urllib.request

KEV = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev = {v["cveID"]: v for v in json.load(urllib.request.urlopen(KEV))["vulnerabilities"]}

hits = []
with open(sys.argv[1], newline="", encoding="utf-8-sig") as f:
    for row in csv.DictReader(f):
        host = row.get("machine") or row.get("Host") or row.get("DNS Name") or row.get("IP") or "?"
        for cve in re.findall(r"CVE-\d{4}-\d{4,}", " ".join(str(v) for v in row.values())):
            if cve in kev:
                k = kev[cve]
                hits.append((k["dueDate"], host, cve, k["knownRansomwareCampaignUse"], k["vulnerabilityName"]))

for due, host, cve, ransomware, name in sorted(set(hits)):
    print(f"{due}  {host:20} {cve:18} ransomware: {ransomware:7} {name}")
print(f"{len(set(hits))} exposures in KEV, on {len({h[1] for h in hits})} machines")

It finds CVE numbers anywhere in a row, so it works with Gardience's export (Security > Vulnerabilities > Download CSV) and with most scanners' CSV exports. Run it:

python3 kev_check.py gardience-vulnerabilities.csv

On our lab's export it printed 0 exposures in KEV, on 0 machines. To make sure it does catch things, we added two test rows for this month's Windows and Collabora CVEs, and it listed both with their due dates:

2026-10-16  test-win-01          CVE-2026-96951     ransomware: Unknown Microsoft Windows Command Injection Vulnerability
2026-10-26  test-web-01          CVE-2026-110447    ransomware: Unknown Collabora Online - Built-in CODE Server OS Command Injection Vulnerability
2 exposures in KEV, on 2 machines

3. Fix those first, then check for a break-in#

For each hit: patch it (or take the machine off the internet until you can), then look for signs someone got there first. For a web application that means files that should not be there and odd requests in the web server log. Then keep the record of what you fixed and when.

What KEV does not tell you#

• It is late by design. A CVE is added after CISA has evidence of attacks. By then, someone has already been hit. Software that faces the internet deserves fast patching whether it is on the list or not.
• No CVE, no entry. Plenty of exploited software never gets a CVE.
• It only knows about what your scanner knows about. If your scanner cannot see a Nextcloud app or a hand-installed copy of Node.js, a KEV cross-check of its results cannot either. We wrote about that blind spot in the Collabora post.
• "Unknown" ransomware use means unknown, not "no."

Questions#

What does KEV stand for?#

Known Exploited Vulnerabilities. It is CISA's catalog of vulnerabilities with evidence of real-world exploitation.

How many vulnerabilities are in the KEV catalog?#

1,758 as of October 26, 2026, with 274 added so far in 2026.

What replaced BOD 22-01?#

BOD 26-04, "Prioritizing Security Updates Based on Risk," issued June 10, 2026. It sets deadlines from three days to the next system upgrade based on KEV status, internet exposure, whether the attack can be automated, and its impact.

What is the KEV deadline now?#

It depends on the entry. Since June 10, 2026, most new entries have a three-day due date, and many require forensic triage. The due date is in each entry.

Do private companies have to follow KEV deadlines?#

Not by law, unless a contract requires it. CISA encourages everyone to follow them, and they are a sensible priority list for any organization.