When the US Cybersecurity and Infrastructure Security Agency adds a software flaw to its Known Exploited Vulnerabilities catalogue, it's saying one thing clearly: attackers are already using this bug. As of 1 October 2026, the catalogue lists 1,731 vulnerabilities.
Glyph · Sunday 4 October 2026
Questions readers ask
What is the CISA KEV catalogue?
The Known Exploited Vulnerabilities catalogue is a public list kept by the US Cybersecurity and Infrastructure Security Agency. Each entry is a specific vulnerability, identified by its CVE number, that CISA has reliable evidence is being exploited in the wild.
How many vulnerabilities are in the KEV catalogue?
As of 1 October 2026 the catalogue lists 1,731 vulnerabilities.
How does a vulnerability get added to the KEV catalogue?
CISA sets three tests: the flaw has a CVE ID, there's reliable evidence of active exploitation, and there's a clear remediation action such as a vendor update, mitigation or workaround.
Who has to follow the KEV deadlines?
Only US federal civilian executive branch agencies are bound by the deadlines under BOD 26-04. CISA says every organisation should still prioritise fixing the vulnerabilities in the catalogue.
Is the KEV catalogue a severity score?
No. KEV is about evidence of exploitation, not severity. A flaw can have a high CVSS score and never be exploited, or a modest score and be used widely.
Sources
- CISA: Known Exploited Vulnerabilities Catalog
- CISA: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (Revoked)
- CISA: Known Exploited Vulnerabilities catalog (JSON feed)
- CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities
- CISA: BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA: BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk
- CISA (YouTube): EAD Chris Butera Explains BOD 26-04
- Australian Cyber Security Centre
This desk has not corrected this file. Corrections.
Related · More in Hacking
Editors' picks this week
- SpaceXSpaceX's Starship reaches orbit and releases 26 Starlink V3s
- Game ReviewsPersona 4 Revival gets a Shadow trailer, still due 18 Feb 2027
- AI / LLMGrok joins XChat group chats, plus a new TypeScript SDK
- RoadsMike Turtur Bikeway now rides over four busy Adelaide roads
- BreakingFDA approves Autus, a heart valve that grows with a child
The paper
Comments
No notes on this story yet.
Sign in to comment