CISA KEV checker: is this CVE in the KEV catalogue?

The Known Exploited Vulnerabilities catalogue is CISA's list of vulnerabilities that it has evidence of being exploited in the wild. CISA tells organisations to use it as an input to prioritising remediation. Each entry has a CVE id, vendor and product, the date it was added, a required action, a due date, a flag for known ransomware campaign use and, since BOD 26-04, a forensic triage flag.

Paste the CVE id or a whole list into the checker above. It reads CVE ids from plain text, scanner CSV or JSON exports in your browser and returns, for each, whether it is in the catalogue, when it was added, CISA's due date, known ransomware use, the forensic triage flag and the EPSS score. You can also browse and filter the full catalogue by vendor, year, ransomware use and triage.

CISA states no fixed schedule on the catalogue page. The cisagov/kev-data repository says updates usually happen on weekdays during US Eastern business hours, and CISA's BOD 26-04 implementation guidance says it aims to update KEV within 24 hours of a determination. We re-check CISA's feed about every two hours and show the catalogue version and release time we hold at the top of the page.

It is a field CISA sets to Known when it has confirmation that the vulnerability has been used in ransomware campaigns, and Unknown otherwise. Unknown means CISA lacks confirmation; it does not mean the flaw is safe from ransomware operators.

No. KEV lists vulnerabilities with evidence of exploitation that CISA has confirmed and for which clear remediation exists; many exploited or soon-to-be-exploited flaws are not listed yet. Check the EPSS score next to it, whether the asset is exposed to the internet, and the vendor advisory.

The due date is the date by which US federal civilian agencies must remediate under CISA's binding directive. Since 10 June 2026 that directive is BOD 26-04, which replaced BOD 22-01. Other organisations are not bound, but use it as a benchmark. For a deadline that reflects your asset's exposure and impact, use the BOD 26-04 calculator.

Yes. CISA publishes JSON and CSV feeds, and the cisagov/kev-data repository mirrors them under CC0. CISA's feed does not allow browsers on other sites to read it directly, which is why this tool serves a synced copy from our own server.