The CISA KEV Catalog: A Practical Guide to Prioritizing Vulnerabilities for Small Businesses

CISA's Known Exploited Vulnerabilities (KEV) catalog is a free, public list of security flaws that attackers are actually using in the wild, each with the fix to apply. For a small business that cannot patch everything at once, it answers the most practical question in IT security: which updates matter first? The short version is to keep an accurate inventory of what you run, check it against the KEV catalog every week, patch any match quickly (internet-facing systems first), and use CVSS and EPSS scores to rank everything else. This guide explains how the catalog works, how to subscribe and a weekly routine that fits a small team.

What the KEV catalog is

The Cybersecurity and Infrastructure Security Agency (CISA) describes the KEV catalog as the authoritative source of vulnerabilities that have been exploited in the wild. A flaw is added only when it meets three criteria:

1. It has a CVE ID, the standard identifier for a public vulnerability.
2. There is reliable evidence of active exploitation. Attempted or successful attacks count. Scanning, research and proof-of-concept code alone do not.
3. There is clear remediation guidance, usually a vendor update.

That third rule is what makes the list so useful: every entry is something you can act on. Each entry lists the vendor and product, the CVE, a short description, the date it was added, a "required action" and whether it is known to be used in ransomware campaigns.

Where BOD 22-01 fits (and what replaced it)

The catalog was created with Binding Operational Directive 22-01, issued in November 2021. That directive required federal civilian agencies to fix listed vulnerabilities by set deadlines: two weeks for most entries and six months for CVEs assigned before 2021. That is where the "due date" column comes from.

On June 10, 2026 CISA issued BOD 26-04, "Prioritizing Security Updates Based on Risk," which revoked and replaced BOD 22-01. It keeps the KEV catalog and its criteria but ranks urgency using four questions: is the vulnerable asset publicly exposed, is the CVE on the KEV list, can an attacker automate the exploit, and does it give partial or total control of the system? Only the highest-risk combinations carry a three-day deadline for agencies.

These directives bind federal agencies only. Private companies have no legal obligation under them. CISA still recommends that every organization review the catalog and make KEV remediation part of its vulnerability management, and the four BOD 26-04 questions are a sensible way for any business to think about risk.

Why "exploited" beats "severe"

Most vulnerability scanners sort findings by CVSS, the Common Vulnerability Scoring System maintained by FIRST. CVSS rates how severe a flaw is on a 0 to 10 scale (in version 4.0: Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0). Severity is important, but it does not tell you whether anyone is actually attacking that flaw. A scan of a modest network can easily return a long list of "High" and "Critical" findings, and treating them all as equally urgent is how teams burn out.

Three signals work better together:

Signal	What it tells you	Where to get it
KEV	Attackers are exploiting it now	CISA KEV catalog
EPSS	Estimated probability of exploitation in the next 30 days (0 to 1)	FIRST, updated daily, free
CVSS	How bad it is if exploited	NVD, vendor advisories, your scanner

A simple rule: KEV first, then high EPSS, then high CVSS. And within each group, fix internet-facing systems (firewalls, VPNs, remote access gateways, websites, email servers) before internal ones.

CISA also publishes extra "Vulnrichment" data for many CVEs, including whether exploitation can be automated and its technical impact, the same factors BOD 26-04 uses.

Step 1: know what you have

The KEV list is only useful if you can match it against your own systems. Start with an inventory, even a spreadsheet:

• Internet-facing devices: firewall, VPN, remote desktop gateways, routers, Wi-Fi controllers
• Servers and hosting: Windows Server, Linux, control panels such as cPanel, web applications and plugins
• Endpoints: Windows and macOS versions, browsers, Office, PDF readers
• Cloud and SaaS admin consoles and anything the business manages itself
• Owner and patch method for each item: automatic, manual or vendor-managed

Many managed IT tools and vulnerability scanners can import the KEV list and flag matches automatically, which CISA itself recommends.

Step 2: subscribe to the catalog

You do not need special tools to follow the catalog:

• Email: the catalog page has a "Subscribe" option (through CISA's GovDelivery service) that sends a notice whenever new entries are added.
• CSV and JSON downloads: the catalog is available as CSV and JSON with a published JSON schema, so a scanner, script or spreadsheet can compare it with your inventory.
• The website: browse or search the entries, each showing its date added and due date.

Route the email notices to a shared mailbox or ticket queue rather than one person's inbox, so they are not missed during vacations.

Step 3: a weekly 30-minute routine

For a small business, a short weekly review is realistic and effective:

1. Read the new KEV additions from the past week. For each, ask: do we run this vendor and product?
2. If yes, check the version against the vendor advisory. If you are affected, open a ticket.
3. Set a target date. A good internal standard is to patch matching internet-facing systems within days and internal systems within your normal cycle, sooner if the entry is marked as used in ransomware campaigns.
4. If you cannot patch yet, apply the vendor's mitigation, restrict access (for example, limit a management interface to the VPN) and record the exception with a review date. CISA's guidance is clear that mitigations are temporary and that end-of-life products that cannot be updated should be removed.
5. Check for compromise on exposed systems. Patching closes the door but does not evict someone who already got in. If an internet-facing device was vulnerable for a while, review its logs, admin accounts and configuration.
6. Review the rest by EPSS and CVSS from your scanner, and schedule them into normal patching.
7. Write down what you did. A short log helps with cyber insurance questionnaires and audits.

For the broader policy that this routine plugs into, see our ransomware prevention guide, and our recent post on critical PHP flaws for an example of how an actively exploited issue is handled.

Common mistakes to avoid

• Ignoring network devices. Firewalls and VPN appliances appear on the KEV list often and are frequently missed because they do not update themselves like laptops.
• Assuming the cloud provider patches everything. SaaS is patched by the vendor, but your own virtual servers, websites and plugins are your responsibility.
• Treating a scan as the inventory. Scans miss devices that are offline or on another network. Keep the inventory separately.
• Chasing every Critical score first. A critical flaw on an isolated internal system can be less urgent than a medium-severity flaw on your VPN that is being exploited today.

Getting started this week

Subscribe to the KEV notices, build or update your inventory and hold the first 30-minute review. If you would rather have someone handle the inventory, scanning and patching for you, request a free IT assessment. Core Florida IT supports businesses across Miami-Dade and South Florida with managed IT support and cybersecurity services.

Sources

• Known Exploited Vulnerabilities Catalog (CISA)
• Reducing the Significant Risk of Known Exploited Vulnerabilities (CISA)
• BOD 26-04: Prioritizing Security Updates Based on Risk (CISA)
• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, revoked (CISA)
• Exploit Prediction Scoring System (FIRST)
• CVSS v4.0 Specification Document (FIRST)