KEV
Stands forKnown Exploited Vulnerabilities
A catalog of vulnerabilities with evidence of exploitation in the wild. A stronger operational signal than severity, because it describes what is happening.
Also calledKEV catalog · exploited in the wild
A catalog maintained by CISA listing vulnerabilities for which there is evidence of active exploitation.
The difference from a severity score is a difference in kind. CVSS says how bad the flaw would be if someone exploited it; the catalog says someone already is. A medium-scored flaw that appears in it is usually more urgent than a high-scored one nobody has touched.
In practice that translates cleanly: presence in the catalog is a reason to move a patch to the front of the queue even when its technical score is not the highest on the list.
[VERIFY] — the catalog's scope and update cadence change over time; check the source before writing policy that references it.