Attack Surface Ranked

FIELD NOTE · 29 SEPTEMBER 2026

CISA KEV and internet-facing assets: a working guide

Quick answer

CISA's KEV catalog lists vulnerabilities with a CVE ID, reliable evidence of exploitation in the wild and a clear remediation action. US federal civilian agencies must remediate them within set timeframes under BOD 22-01, and CISA recommends everyone else address them immediately. For attack surface teams, a KEV match on an internet-facing asset is the second-highest priority after a validated exposure.

By Attack Surface Ranked analysts · Published 29 September 2026 · 3 min read

What is the KEV catalog?

The Known Exploited Vulnerabilities catalog is maintained by CISA, the US Cybersecurity and Infrastructure Security Agency. A vulnerability is added when it meets three criteria: it has an assigned CVE ID, there is reliable evidence that it has been actively exploited in the wild, and there is a clear remediation action, such as a vendor update. The catalog is public.

The three criteria make KEV different from a severity score. CVSS describes how bad a flaw could be. KEV records that attackers are already using it.

What does BOD 22-01 require?

Binding Operational Directive 22-01 requires US federal civilian executive branch agencies to remediate vulnerabilities in the KEV catalog within set timeframes. It does not bind private companies. CISA's recommendation to other organizations is to include a requirement to immediately address KEV catalog vulnerabilities as part of their vulnerability management plan.

Why does KEV matter more for the external attack surface?

Internet-facing assets are reachable by anyone, so an exploited vulnerability on one of them is exposed to the same attackers that put it in the catalog. They are also the assets most likely to sit outside normal patch cycles: acquired companies' sites, brand microsites and forgotten test systems.

KEV also cuts noise. FIRST projects about 66,000 CVEs in 2026, but in its June release it noted that, filtered for CISA KEV entries or EPSS scores above 10%, the patching burden has not materially increased. KEV is one of the two filters FIRST names.

How should you work KEV matches?

  1. Match the catalog against your internet-facing inventory, not only against assets you already scan. An ASM tool's discovery is what finds the unlisted ones.
  2. Confirm the asset is yours and has an owner. A match on a supplier's asset goes to the person who manages that supplier.
  3. Confirm exposure. A KEV entry says the flaw is exploited somewhere; validation says whether it can be exploited on this asset. If it can, the finding moves to the top of the queue.
  4. Fix, or mitigate while the fix waits. A WAF rule is a common compensating control for web applications; our note on virtual patching covers the approvals.
  5. Retest once the fix is in, and close the finding only then.
  6. Report KEV matches still open on internet-facing assets, and the age of the oldest, every week.

Two practical details help. First, record the date a vulnerability was added to the catalog against each match, so the weekly report shows how long a known exploited flaw has been open on your perimeter rather than how long the finding has existed. Second, when a new entry is added, run the match against the full inventory the same day. The time between a catalog addition and a decision on each affected internet-facing asset is one of the clearest measures of whether the program keeps pace. Measuring an ASM program covers the other metrics.

How do ASM tools use KEV?

Support varies, and it is worth asking how often a tool refreshes the catalog. On public documentation, Censys ASM applies EPSS and KEV scoring alongside reachability confirmation, and watchTowr lists a known exploited vulnerabilities agent among its eight attack agents. Tools that validate exploitability can go one step further and tell you whether a KEV-listed flaw is exploitable on your asset. Our validation criterion carries 15% of the weighted score; see the score matrix.

What does KEV not tell you?

  • Whether your asset is affected. That needs an accurate inventory and version detection, or validation.
  • Everything that is being exploited. The catalog lists what meets CISA's criteria, not every attack.
  • Your business context. A KEV match on a customer-facing payment site and one on an unused test host are not the same priority.

For the full order of work, combining validation, KEV, EPSS and CVSS, see how to prioritize external exposures.

Sources

Related on this site