CISA Known Exploited Vulnerabilities (KEV) Catalogue

The CISA Known Exploited Vulnerabilities (KEV) catalogue is a continuously updated list of CVEs that the US Cybersecurity and Infrastructure Security Agency (CISA) has determined are being actively exploited by threat actors in the wild. Unlike the NVD, which lists all known vulnerabilities, the KEV catalogue is a curated, high-signal subset: entry requires credible evidence of active exploitation — not theoretical exploitability. The catalogue is publicly accessible and machine-readable (JSON format), and is updated when CISA receives reliable exploitation evidence. As of 2025, the catalogue contains thousands of entries across a wide range of software and hardware products.

Article 14(1) of the CRA requires manufacturers to notify ENISA within 24 hours of becoming aware that a vulnerability in their product is being actively exploited. The CISA KEV catalogue is the most reliable public signal of active exploitation. If a KEV entry is published for a CVE affecting a component in a manufacturer's shipped product, this is prima facie evidence that the Article 14(1) trigger has been met and the 24-hour notification clock has started. Manufacturers who monitor the KEV catalogue continuously and have it integrated with their SBOM management will know within hours whether a new KEV entry affects their products — enabling them to meet the notification deadline.

Manufacturers should integrate KEV monitoring into their vulnerability management workflow as a highest-priority alert source. Practical implementation includes: (1) subscribing to the CISA KEV RSS feed or API endpoint; (2) configuring SCA and SBOM management tools to cross-reference new KEV additions against the component inventory of all shipped products; (3) defining a specific incident response playbook for KEV matches — distinct from standard CVE triage — with a defined escalation path and ENISA notification template; (4) testing this playbook in regular tabletop exercises; and (5) ensuring the on-call product security team is alerted immediately when a KEV addition matches a shipped product component. Time-to-detect is critical given the 24-hour notification window.

The most dangerous mistake is treating the KEV catalogue as a US-specific resource with no EU relevance. The CRA's active exploitation notification trigger is not geographically limited — exploitation evidence from any region, including KEV catalogue addition, counts as the trigger. Manufacturers who monitor only European threat intelligence sources will miss KEV additions that would trigger their Article 14(1) obligations. A second error is not having a KEV-specific response workflow: standard CVE triage processes are typically too slow (days to weeks) to meet the 24-hour notification window that KEV additions effectively trigger.