KEV catalog

A technical detail that explains everything: every known software hole gets a unique number, a CVE, issued by an international cataloging system. There are thousands of holes, most never touched by anyone outside a research lab. CISA takes from that mass only the ones with hard confirmation that a real attacker has already used them, and puts them in KEV. The difference isn't a nuance. The difference is a chasm: one is 'theoretically possible', the other is 'already happened'.

In practice it works like this. A new hole comes out, someone reports seeing an attack through it, CISA verifies it and adds it with a mandatory deadline for every US federal agency to patch it. The deadline varies: sometimes two weeks, and for the most urgent ones just three days. In July 2026 alone, new entries were added within days. This isn't a bureaucratic slip of paper. It's a timer, started the moment it's added.

The catalog launched in 2021 and as of October 8, 2026 holds 1,739 entries. It exists because companies and institutions are drowning in warnings about thousands of potential holes and don't have the resources to patch everything at once. KEV tells them what's on fire right now, and what's only on paper. The priority shifts from 'how dangerous is it theoretically' to 'how dangerous is it in practice, because it's already been used'.

It's used by far more people than it sounds. US federal agencies are required to by law, but private companies around the world, including here, feed the KEV list directly into their security software, so it lights up red automatically when something in their systems matches an entry in the catalog. This is the list a real security team builds its workday around.

Old holes get in too. On October 8, 2026 CISA added five at once, all from the list in the joint advisory about the Chinese company Integrity Tech: in ISC BIND, ProFTPD, Apache Struts, ONLYOFFICE Docs and Strapi. Their numbers run from 2015 to 2023. The deadline for US federal agencies is October 11, a Sunday, three days after the listing. A hole doesn't age on its own. It ages when you patch it.

One week shows how tight the clock is. From October 13 to 16, 2026 CISA listed 9 holes, and every one of them has a three-day deadline. Among them are Ivanti Connect Secure, Windows, Cisco's email gateway, Palo Alto Networks' PAN-OS and BeyondTrust Remote Support. The timer starts on the day of listing.

The same thing happened again on October 23, 2026: CISA listed two holes and the deadline for both is October 26, a Monday, again three days. One is in Arista's VeloCloud Orchestrator (CVE-2026-114625). Arista itself writes that it detected the hole, that it is being actively exploited, and that no configuration can prevent the exposure. For this product it is the second time in a month: on September 22 another hole in it entered the catalog. The second is in Collabora Online (CVE-2026-110447): the vendor describes it as an operating-system command that needs no login, and it is in the catalog because CISA listed it.

An example of 'patched' and 'attacked' going together: on October 26, 2026 CISA listed the two holes in PHP itself, CVE-2026-109618 and CVE-2026-109619. The deadline for US federal agencies is October 29, again three days, and the clock started five days after PHP released its fixes on October 21. The patch was out, and the holes still made it onto the list of the actively exploited.

Another example is from October 28, 2026: CISA listed a hole in the logging of VMware ESX (CVE-2026-41709) and a hole in the Linux kernel (CVE-2026-46300). The deadline for federal agencies is November 11 for the first and October 31 for the second, three days after the listing. Both are old: the patches came months before the listing, and Broadcom published its ESX advisory as early as July 29. Broadcom does not write that the hole is used in attacks. That it is actively exploited is said only by CISA's catalog. And the ESX hole itself has a low score (2.7) and needs administrator rights already: an attacker covering their tracks.

On October 29, 2026 CISA listed two more holes: in GitLab (CVE-2026-97229) and in Cisco's firewall, the ASA and FTD models (CVE-2026-76418). The deadline for both is November 1, a Sunday. The GitLab patch came out as early as October 12, the hole has the highest score, 10.0, and it lets an unauthenticated attacker run code on the server. GitLab's notice does not say the hole is used in attacks. That is what CISA's catalog says. With Cisco the hole makes the device reload unexpectedly, and Cisco itself writes that in October 2026 its security team became aware of active exploitation. The lesson is simple: a patch from weeks ago does not mean an old story. The listing comes when the attacks begin.

KEV doesn't look forward. It looks back - a protocol for the past: every entry on the list means someone was already a victim, before it ever reached the catalog.

Watching the staging

The most honest part of this list is exactly what makes it valuable: the delay. You only make it onto it after the harm has already been done somewhere. That's why I don't look at KEV as an alarm system. I look at it as an autopsy protocol - one that happens to update fast enough to save the next victim.

For me, as someone who builds software systems, this is the simplest possible filter against noise: thousands of warnings, one dimension that actually matters, whether it's already hit someone. Everything else is theory, and theory doesn't hurt.

The visual is generated code-art, no third-party images.