Resources · 23
Prioritize vulnerabilities and verify remediation
Connect known exploitation, exposed assets, business impact and proof of a working fix.
· 9 min
What this guide helps achieve
- Match alerts to assets
- Rank actual urgency
- Roll out safely
- Verify and close
Quick check
- Is the affected product and version actually deployed?
- Is the asset reachable and business critical?
- Is exploitation documented?
- What protects the service before a patch?
- Does a check confirm the problem is gone from the asset?
Step-by-step method
- 01
Consolidate the inventory
Map services, products, versions, environments, exposure and owners. A component advisory alone does not prove that a vulnerable instance is deployed.
Deliverable: dated affected-asset list and uncertainties.
- 02
Qualify the finding
Compare the vendor advisory, CVE identifier, exploitation conditions and, where relevant, CISA’s catalog of known exploited vulnerabilities. Record when each source was checked.
Deliverable: finding with primary references.
- 03
Set a defensible priority
Consider known exploitation, asset reachability, required privileges, data handled, service impact and available remediation. Assign an owner and context-specific deadline.
Deliverable: reasoned priority decision.
- 04
Prepare the change
Map dependencies, change window, backup and rollback. If an update cannot be applied promptly, record the temporary control and its expiry.
Deliverable: rollout plan and limited exception.
- 05
Deploy and test
Apply the vendor fix or mitigation using the approved process. Check the resulting version, business journey and integrations that may regress.
Deliverable: deployment record and functional result.
- 06
Verify closure
Check the actual asset with a suitable method, find missed instances and revisit exceptions. Do not close a ticket because an update was merely scheduled.
Deliverable: verification evidence and updated register.
Management indicators
| Indicator | What it measures | First action |
|---|---|---|
| Coverage | Critical assets with known versions and owners | Complete the inventory |
| Delay | Time from qualification to verified fix | Remove repeated bottlenecks |
| Verification | Fixes retested on real assets | Reopen closures without evidence |
| Exceptions | Waivers with control, owner and expiry | Close expired exceptions |
Common pitfalls
- Ranking solely by a generic score without checking the asset
- Assuming a KEV listing means the product exists in your estate
- Deploying without testing service behaviour
- Leaving compensating controls without a review date
Frequently asked questions
Must the highest-scored CVE always go first?
A score describes technical severity; known exploitation, exposure and local service impact guide your operational order.
What if no patch exists?
Follow vendor mitigations, reduce exposure where possible and document an owner, review date and residual risk.
When is the work closed?
After the version or mitigation has been verified on affected instances and critical functionality has been tested.
References: data, uses and limitations
Documentation reviewed on .
| Source and purpose | Verified data or benchmark | How to use it | Limitation to retain |
|---|---|---|---|
| FIRST · CVSS Describe technical vulnerability severity using an explicit method and vector. |
CVSS 4.0 scores run from 0.0 to 10.0. Base, Threat, Environmental and Supplemental metric groups serve different purposes. | Retain the score version, vector and date. Compare it with the installed version, access paths and business consequences before ordering remediation. | A high score is not evidence of exploitation; a low score does not mean a service has no risk. |
| FIRST · EPSS Estimate exploitation probability for a published CVE. |
The model looks ahead 30 days. Its score is a probability; its percentile ranks that score relative to other CVEs. | Record the data date and distinguish probability from percentile. Add asset exposure and confirmed exploitation evidence. | The model does not predict harm to your organisation. Low probability does not cancel a critical exposure. |
| CISA · Known Exploited Vulnerabilities Identify vulnerabilities listed by CISA as known to be exploited. |
The catalogue includes CVE, product, date added and required action. Its official repository also provides the data schema. | Check applicability to your products and retain the access date. Review the requested action and vendor advisory before confirming remediation. | Absence from the catalogue does not establish safety. Administrative deadlines in it are not automatically binding on every organisation. |
CVSS, EPSS, KEV and VEX
Vulnerability prioritisation: four signals to connect to the asset
A vulnerability queue often mixes information answering different questions. CVSS describes technical severity, EPSS estimates a probability of observed exploitation, KEV records known exploitation and VEX carries a product applicability assertion. A local decision still needs the deployed version, access paths and consequences of exploitation.
These are documentary reference points. EPSS examples, situations and the VEX product are fictional; no current CVE score, real inventory or scan result is presented. This page calculates neither CVSS, organisational risk nor an automatic priority. Proposed evidence and decisions are a local editorial method.
Four independent panels: CVSS describes severity; EPSS estimates observed exploitation within thirty days; KEV records known exploitation; VEX states declared applicability. Compare them with the deployed product and its context without adding them into one score.
Four questions and four kinds of information
| Source | Useful question | What it cannot establish alone |
|---|---|---|
| CVSS 4.0 | What is the technical severity under the assessed metrics? | The score proves neither exploitation nor consequences for your service. |
| EPSS | What is the estimated probability of observing exploitation of this CVE in the next thirty days? | It does not describe compromise of your instance, its controls or business loss. |
| CISA KEV | Is the vulnerability listed as known to be exploited? | Listing does not establish that the product exists in your estate; absence does not establish safety. |
| VEX | What does an issuer assert about a vulnerability for identified products at a stated time? | An assertion alone proves neither deployment of the relevant version nor issuer trustworthiness. |
CVSS 4.0: preserve groups, vector and assessment author
A number from 0 to 10 loses meaning when its version, vector and assessed groups disappear. FIRST distinguishes CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE. Undefined Threat and Environmental metrics take default values rather than disappearing from the calculation.
| Group | Role | Reading check |
|---|---|---|
| Base | Intrinsic vulnerability characteristics. | A supplier’s CVSS-B is not your priority decision. |
| Threat | Threat characteristics that can change over time. | Date the assessment and explain exploitation information used. |
| Environmental | Characteristics specific to the consumer’s environment. | State the controls and system importance considered rather than silently changing a score. |
| Supplemental | Additional context, such as Safety or Recovery. | These metrics do not modify the final CVSS score; they may inform a separate local analysis. |
EPSS: probability, percentile and missing data
FIRST describes a probability from 0 to 1, updated daily, over a thirty-day horizon. The percentile is a relative rank among currently scored vulnerabilities. Do not add probability and percentile or turn their pair into the probability of an attack on your organisation.
| Fictional example | Provided values | Correct reading |
|---|---|---|
| A probability | Probability : 0.05 · Percentile : Unspecified | 0.05 means a 5% estimated probability of observed exploitation within the model horizon, rather than an estate compromise rate. |
| Probability and rank | Probability : 0.02 · Percentile : 0.97 | In this fictional example 0.02 means 2%, while 0.97 places the score at the 97th percentile. The rank does not turn a 2% probability into 97%. |
| No received value | Probability : Unspecified · Percentile : Unspecified | Missing data remains unknown; it is neither zero nor evidence of no exploitation. Record the failure or the date of the last available value. |
Seven useful readings of the KEV schema
The official CISA repository schema describes the catalogue and its entries. The following selection helps retain consultation context rather than enumerate every field. Match each entry to the supplier advisory and actual asset.
| Fields | Meaning | Proposed check |
|---|---|---|
| catalogVersion / dateReleased | Catalogue version and publication time. | Keep a reference to the consulted edition; distinguish publication time from your assessment time. |
| cveID / vendorProject / product | Identifier and product associated with the entry. | Match name, version, distribution and embedded components before declaring an asset affected. |
| dateAdded | Date the vulnerability entered the catalogue. | Do not present it as the first exploitation date or CVE publication date. |
| requiredAction | Requested action to address the vulnerability. | Read the complete instruction and supplier references, then document local implementation. |
| dueDate | Catalogue deadline for the requested action. | Check the context and scope of the CISA instruction before adopting it as a local deadline. |
| knownRansomwareCampaignUse | Known indicates confirmed ransomware campaign use; Unknown means CISA lacks confirmation. | Do not translate Unknown into never used or a definite false value. |
| cwes | Weakness category codes associated with the entry. | Use categories to group causes; they do not replace the CVE identifier or affected version. |
Six fictional situations: what is missing before a decision?
High severity, product not located
An advisory reports high severity; the inventory cannot locate that version in the estate.
Confirm presence and version with the owner, including embedded dependencies.
Retain applicability unknown. Absence from an incomplete inventory does not justify closure.
Known exploitation, exposed instance
The vulnerability is listed as known to be exploited and an owner confirms an affected internet-accessible instance.
Review supplier actions and arrange exposure reduction and remediation suited to the service.
Name the owner, interim control and expected verification evidence; a severity score alone supplies none of this traceability.
Low probability, essential service
The fictional EPSS probability is low, but the affected instance supports an essential service.
Assess consequences and access paths before agreeing a change window.
Do not treat a low score as insurance; that instance’s controls are not contextual inputs to EPSS.
VEX for another version
The supplier declares version 2.4.0 not affected; the asset still runs 2.3.0.
Seek an assertion applicable to the installed version and verify its provenance.
Do not extend a conclusion across versions. A VEX document deploys no update.
Temporary control becomes permanent
A temporary rule reduces access; its review date has passed.
Check that it still protects the relevant path, then decide whether to maintain it or apply the fix.
Keep the owner, limits and a new review date. A perimeter control is not automatically an OpenVEX built-in product mitigation.
Patch announced, deployment unverified
A fixed release is available, but the ticket contains only a download link.
Check the version actually deployed, remaining instances and critical functionality.
Close on implementation and verification evidence, rather than the supplier’s availability of a patch.
Eight records for a traceable remediation decision
- Product, version or build, environment and asset owner.
- Vulnerability identifier, supplier advisory and relevant exploitation conditions.
- CVSS version, vector, metric-group nomenclature and assessment author.
- EPSS date, probability and percentile in separate fields, or an explicit missing value.
- Dated KEV status, requested action and consulted catalogue edition.
- Applicable VEX assertion: issuer, product, version, time and any justification.
- Reasoned local decision, interim control, owner and review date.
- Deployment or mitigation evidence, verification result and remaining limits.
Read VEX statuses and applicability conditions →
Primary sources and scope
- FIRST · CVSS 4.0 Specification · CVSS 4.0 · document 1.2 · reviewed 2026-10-22
Overview · Assessment · Nomenclature · Supplemental Metrics - FIRST · EPSS Frequently Asked Questions · Living FAQ · reviewed 2026-10-22
What is EPSS? · Reading the score · Percentile · Score changes - CISA · KEV official data schema · Official CISA mirror · reviewed 2026-10-22
Catalog properties · vulnerability properties · required fields - OpenVEX · Specification v0.2.0 · OpenVEX v0.2.0 · reviewed 2026-10-22
Statement Data Structure · Status Labels · Status Justifications · Data Inheritance
Sources checked on
Build signatures and provenance
Verify patch origin and then its application
A fixed version needs connecting to the received package and updated instance. Provenance verification helps establish expected origin; remediation confirmation still requires checking the active version and relevant behaviour.
- Keep the accepted patch digest and signature/provenance verification results.
- Match that package to the version actually deployed on each targeted instance.
- Do not close on authenticity alone: document remediation checks, regressions and remaining limits.
Read the pre-deployment provenance reference →
Sources checked on · SLSA 1.2 · Build: Verifying artifacts · SLSA 1.2 · Build: Provenance · SLSA 1.2 · Build: Track Basics · in-toto · Statement v1 · Sigstore · Verifying Signatures
Explore the CISA KEV catalogue
KEV is CISA’s catalogue of vulnerabilities known to be exploited. This explorer contains a complete dated snapshot, not a live feed. A CVE or product-name match is a lead to compare with the exact deployed product and version; it does not prove that a visitor’s system is vulnerable or compromised.
Entry names, products, descriptions, required actions and links retain CISA’s language and values. Explanations are editorial. Entries may be added or corrected after this snapshot; consult the official source before an operational decision.
- Entries
- 1769
- Distinct vendor/project labels
- 291
- Catalogue release date
Counters describe this snapshot only. They do not measure attack counts, vulnerability prevalence or an organisation’s risk. Distinct vendorProject labels are counted exactly as published, without merging aliases or treating them as distinct companies.
Unknown means CISA lacks confirmation of use in a ransomware campaign; it does not mean no exploitation. forensicTriage Yes/No is a separate field described by the schema with a reference to BOD 26-04. An absent field stays unreported. Neither No nor Unknown demonstrates that your asset has not been compromised.
dueDate is the deadline published in the CISA entry for the stated action. It is not a universal SLA, a patch release date or evidence that a patch was installed. The forensicTriage field alone cannot determine your obligations or define an investigation plan.
Six readings that prevent a misleading priority
| Published field | Useful reading | Conclusion to avoid |
|---|---|---|
| cveID | Join sources discussing the same vulnerability. | The identifier year does not date KEV inclusion. |
| vendorProject · product | Find the vendor advisory and local inventory. | A product name does not replace affected versions and configurations. |
| dateAdded | Date the entry’s inclusion in this catalogue. | Do not call it discovery or first-exploitation date. |
| dueDate · requiredAction | Read the published action and deadline together. | Do not turn the date into a universal obligation or proof of remediation. |
| knownRansomwareCampaignUse | Preserve Known, Unknown or an absent field. | Unknown is not No and does not remove the known exploitation signal underlying KEV. |
| forensicTriage · cwes | Separate CISA’s indicator from published weakness classes. | A CWE is not a specific product or score; No is not a certificate that no incident occurred. |
Catalogue additions by year
Results : 285 / 1769 · Page 1 / 12
| CVE | Vendor or project · product | Date added / Entry due date | Use in ransomware campaigns / forensicTriage |
|---|---|---|---|
| CVE-2026-19868 CWE-308 | SonicWall SonicOS SSLVPN Entry and action published by CISASonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilitySonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
|
|
|
| CVE-2024-27834 CWE-287 | Apple Multiple Products Entry and action published by CISAApple Multiple Products Improper Authentication VulnerabilityApple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
|
|
|
| CVE-2026-119977 CWE-367 | WordPress WordPress Core Entry and action published by CISAWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityWordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
|
|
|
| CVE-2026-111357 CWE-306, CWE-862, CWE-345 | Ivanti Connect Secure Entry and action published by CISAIvanti Connect Secure Missing Authentication for Critical Function VulnerabilityIvanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
|
|
|
| CVE-2026-118527 CWE-340 | Ivanti Connect Secure Entry and action published by CISAIvanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
|
|
|
| CVE-2026-76418 CWE-690 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Entry and action published by CISACisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
|
|
|
| CVE-2026-97229 CWE-190 | GitLab Community Edition and Enterprise Edition Entry and action published by CISAGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityGitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
|
|
|
| CVE-2026-41709 CWE-778 | Broadcom VMware ESX Entry and action published by CISABroadcom VMWare ESX Insufficient Logging VulnerabilityBroadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
|
|
|
| CVE-2026-46300 CWE-456 | Linux Kernel Entry and action published by CISALinux Kernel Missing Initialization of a Variable VulnerabilityLinux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
|
|
|
| CVE-2026-111497 CWE-252, CWE-787 | Google Brotli Entry and action published by CISAGoogle Brotli Unchecked Return Value VulnerabilityGoogle Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
|
|
|
| CVE-2026-48356 CWE-434 | Adobe Commerce and Magento Entry and action published by CISAAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityAdobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
|
|
|
| CVE-2026-109618 CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 | PHP Group PHP Entry and action published by CISAPHP Memory Corruption VulnerabilityPHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
|
|
|
| CVE-2026-109619 CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 | PHP Group PHP Entry and action published by CISAPHP Stale Internal Request-State VulnerabilityPHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
|
|
|
| CVE-2026-110447 CWE-78 | Collabora Collabora Online – Built-in CODE Server Entry and action published by CISACollabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
|
|
|
| CVE-2026-114625 CWE-89 | Arista VeloCloud Orchestrator Entry and action published by CISAArista VeloCloud Orchestrator SQL Injection VulnerabilityArista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
|
|
|
| CVE-2026-106931 CWE-78 | EG Secure Solutions SiteGuard Server Edition Entry and action published by CISAEG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityEG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
|
|
|
| CVE-2026-110936 CWE-427 | Siemens Software Center Entry and action published by CISASiemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
|
|
|
| CVE-2026-96652 CWE-918 | Plex Media Server Entry and action published by CISAPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
|
|
|
| CVE-2026-96654 CWE-84 | Plex Media Server Entry and action published by CISAPlex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityPlex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
|
|
|
| CVE-2026-96655 CWE-918 | Plex Media Server Entry and action published by CISAPlex Media Server Server-Side Request Forgery (SSRF) VulnerabilityPlex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
|
|
|
| CVE-2026-96656 CWE-73 | Plex Media Server Entry and action published by CISAPlex Media Server External Control of File Name or Path VulnerabilityPlex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
|
|
|
| CVE-2025-61624 CWE-22 | Fortinet Multiple Products Entry and action published by CISAFortinet Multiple Products Path Traversal VulnerabilityFortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
|
|
|
| CVE-2026-102764 CWE-290 | BeyondTrust Remote Support Entry and action published by CISABeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
|
|
|
| CVE-2026-21589 CWE-552 | Atlassian Multiple Products Entry and action published by CISAAtlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityMultiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
|
|
|
| CVE-2026-0322 CWE-94 | Palo Alto Networks PAN-OS Entry and action published by CISAPalo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
|
|
|
An old identifier can enter the catalogue recently
CVE-2015-5477, associated with ISC BIND in this snapshot, has identifier year 2015 and dateAdded 8 October 2026. These dates answer different questions. The entry calls for following vendor instructions; it does not establish your BIND version, exposure or installation of a fix.
From a public signal to a documented decision
- Qualify the match
Keep the CVE, source and date, then establish product, version, embedded component and exposure. An SBOM may locate a component without proving its runtime condition.
- Read the action at its source
Open the vendor advisory and updates. Separate updating, mitigation, discontinuing a product and searching for compromise evidence; a patch does not replace these other decisions.
- Document the change
Assign an owner, prepare rollback and verify dependencies. A mitigation remains a scoped measure with an explicit validity period.
- Verify the resulting state
Retain an observed version, checked configuration and service test. Closing a task needs evidence concerning the actual asset, beyond a console status.
Source release : · Documentary review :
- CISA · KEV official snapshot · 2026.11.06
- CISA · KEV data schema · JSON Schema Draft 07 · pinned source
- CISA · Official mirror and reuse terms · Official repository · pinned source
- CISA · KEV licence · CC0 1.0 Universal
- FIRST · CVSS · CVSS 4.0
- FIRST · EPSS · Living documentation · reviewed 2026-10-22
CISA KEV data reused under CC0 1.0. Reuse implies no CISA affiliation or endorsement and grants no right to use the CISA logo or DHS seal.
Reference details · CISA KEV
How we publish this official snapshot
The copy is identified by its catalogue version, dateReleased, official mirror commit and source-file digest. CISA publication, GitHub synchronisation and our review are distinct events. Aggregates are computed from the retained entries; no visitor inventory collection or vulnerability scan takes place.
- catalogVersion
2026.11.06- dateReleased
- GitHub commit
e5b3a9b25050a8da26c96266c5bfe438ee0bdebc·- SHA-256
47e0406b2be5a40420eff66f3d90e83eb8883dae6ff4d08e1b2a942c366f6cc2
Counters describe this snapshot only. They do not measure attack counts, vulnerability prevalence or an organisation’s risk. Distinct vendorProject labels are counted exactly as published, without merging aliases or treating them as distinct companies.
Explore the catalogue and method →
Source release : · Documentary review :
- CISA · KEV official snapshot · 2026.11.06
- CISA · KEV data schema · JSON Schema Draft 07 · pinned source
- CISA · Official mirror and reuse terms · Official repository · pinned source
- CISA · KEV licence · CC0 1.0 Universal
- FIRST · CVSS · CVSS 4.0
- FIRST · EPSS · Living documentation · reviewed 2026-10-22
CISA KEV data reused under CC0 1.0. Reuse implies no CISA affiliation or endorsement and grants no right to use the CISA logo or DHS seal.
Official references
References consulted: . The method and worksheet propose checks to adapt to your context; they do not constitute certification.
- NIST SP 800-40 Rev. 4 — enterprise patch management
- CISA — Known Exploited Vulnerabilities Catalog
- FIRST · CVSS
- FIRST · EPSS
- CISA · Known Exploited Vulnerabilities
- SLSA 1.2 · Build: Verifying artifacts
- SLSA 1.2 · Build: Provenance
- SLSA 1.2 · Build: Track Basics
- in-toto · Statement v1
- Sigstore · Verifying Signatures
- CISA · KEV official snapshot
- CISA · KEV data schema
- CISA · Official mirror and reuse terms
- CISA · KEV licence
- FIRST · CVSS
- FIRST · EPSS Frequently Asked Questions
- CISA · KEV official data schema
- OpenVEX · Specification v0.2.0
Continue exploring
Related analysis
