Who has to follow the KEV catalog?

US federal civilian agencies are required to fix listed vulnerabilities by their due dates under CISA's binding directives. Everyone else is not obliged to, but CISA recommends all organizations use the catalog to prioritize patching, because it lists what attackers are already using.

How fast do KEV vulnerabilities have to be fixed?

For federal agencies, the due date is set per entry. Recent entries carried short windows: in late September 2026 the due dates shown were three days after the date added, and the Cisco Secure Email Gateway flaw added on 14 October had a 72-hour window. Businesses are not bound by these dates, but they are a good measure of urgency.

How do I check if my software is on the KEV list?

List the products and versions you run, including your website platform, VPN, email gateway, and the frameworks and libraries inside your own applications. Then compare them against the catalog, which CISA publishes as a searchable page and as CSV and JSON files you can filter automatically. Subscribe to CISA's email updates to hear about new entries.

What were notable KEV additions in October 2026?

Among others: Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day since at least 1 October; Cisco Secure Email Gateway CVE-2026-76519, a root-level flaw triggered by a malicious email; a Windows flaw fixed in October's Patch Tuesday; and an Atlassian flaw added on 15 October. In September, LiteLLM CVE-2026-59822 became the first MCP vulnerability on the list.

CISA KEV: What It Is and How a Business Should Use It

Q: What is CISA KEV?

The Known Exploited Vulnerabilities catalog, published by the US Cybersecurity and Infrastructure Security Agency. CISA calls it the authoritative source of vulnerabilities that have been exploited in the wild. In mid-October 2026 it listed 1,746 entries, each with the vendor, product, a short description, the required action and a due date.

A tray of index cards with one card pulled forward and glowing with a warning sign, an arrow leading to a server receiving a patch piece, next to a calendar

CISA KEV is the Known Exploited Vulnerabilities catalog: the list, kept by the US Cybersecurity and Infrastructure Security Agency, of software flaws that attackers are actually using. CISA calls it "the authoritative source of vulnerabilities that have been exploited in the wild". In mid-October 2026 it held 1,746 entries. Federal agencies must fix each one by a due date that is often only days away. Businesses aren't obliged to, but they should care more than anyone: tens of thousands of vulnerabilities are published every year, and almost nobody can patch all of them. KEV is the short list of the ones being used against real targets right now. Below: what is in it, how to use it without a security team, and the entries that mattered in October.

What a KEV entry tells you

Each entry in the catalog gives:

the CVE identifier, vendor and product;
a short description of the flaw;
the required action, usually "apply mitigations per vendor instructions", or discontinue the product if no fix exists;
the date added and the due date for federal agencies.

The due dates are short. Recent entries carried three days between the date added and the due date, and the Cisco Secure Email Gateway flaw added on 14 October had a 72-hour window. That is how seriously CISA treats active exploitation.

Why a business should use it

The problem with patching is not willingness. It is volume. A typical company runs dozens of products, each with its own advisories, and patching everything immediately is not realistic.

KEV solves the prioritization problem for you. A vulnerability with a high severity score might never be exploited. One on KEV already is. If something you run is on the list, it goes first.

How to use it without a security team

Make the list of what you run. Not just laptops. Your VPN or remote-access gateway, firewall, email gateway, website platform and plugins, file-transfer tools, and the frameworks and libraries inside any software built for you. The last category is the one people forget.
Subscribe to new entries. CISA sends email updates, and publishes the catalog as CSV and JSON, so a script or your IT provider can match it against your inventory automatically.
Set your own deadline. Not three days, perhaps, but a written rule, such as "KEV entries on internet-facing systems within a week".
Ask your suppliers. Whoever builds or hosts your software should be able to answer, on any given day, "are we running anything on KEV?". If they can't, nobody is watching.
Retire what can't be patched. KEV entries for products past end of life tell you to discontinue them. That applies to Windows Server 2016 from January 2027, and to the supermarket refrigeration controllers hacked in France.

Notable entries, October 2026

Ivanti Connect Secure, CVE-2026-104935: remote code execution, exploited as a zero-day since at least 1 October, added 13 October (BleepingComputer).
Cisco Secure Email Gateway, CVE-2026-76519: root-level command execution triggered by sending a malicious email, added 14 October with a 72-hour federal window.
Microsoft Windows, CVE-2026-96951: exploited before October's record Patch Tuesday, which fixed 1,413 vulnerabilities in total.
Atlassian, CVE-2026-21589: added 15 October (CISA).
Earlier, on 2 September: LiteLLM CVE-2026-59822, the first flaw in an AI tool's MCP endpoint to make the list. Our write-up.

That last one is a signal. AI gateways and agent tooling are now on the same list as VPNs and email gateways, which means the software inside your applications needs the same watching as the boxes on your network.

What we do for the software we run

For the applications we build and host, keeping the dependency list current is our job, not the client's. Dependabot watches the dependencies of every repository, a scheduled scan re-checks the main branch of every live application, and anything it finds becomes a ticket. Administration interfaces are never reachable from the internet, which takes a whole category of KEV entries off the table. The details are on our security page. Maintenance, including security updates as they come out, starts around $470 a month.

Also: .NET 8, .NET 9 and Python 3.10 end of life.

CISA KEV Explained: The Patch List Every Business Should Watch

There are tens of thousands of new vulnerabilities a year. The KEV catalog is the short list of the ones attackers are actually using. Federal agencies must patch them in days. Here is how a business without a security team can use the same list.