Post cover image
Photo by Tim Mossholder on Unsplash

November 2, 2026

Patch What’s Actually Being Exploited: Prioritizing With the CISA KEV Catalog

Dozens of critical CVEs a month, and a team that can’t patch everything at once. The question isn’t “which flaw is most severe?” but “which…

By yedidhe

1 min read

Dozens of critical CVEs a month, and a team that can't patch everything at once. The question isn't "which flaw is most severe?" but "which one is already being exploited?".

If you rank fixes by CVSS score alone, you'll spend your time on flaws that look serious on paper but are never exploited, while lower-scored vulnerabilities are already in attackers' hands. CISA's KEV catalog corrects that bias.

What the KEV catalog is

The Known Exploited Vulnerabilities catalog, published by the US agency CISA, lists vulnerabilities with confirmed real-world exploitation. Each entry gives the product, a description, the required action and a remediation deadline for US federal agencies. It's free, continuously updated and downloadable as CSV or JSON.

Why it's a better filter

A flaw in KEV is no longer a theoretical risk: someone is using it. That's exactly the information CVSS lacks. Edge devices (firewalls, VPN gateways, load balancers) show up regularly, which makes it essential for network teams. Just this month, a PAN-OS management interface flaw (CVE-2026–0322) was added (The Hacker News).

None

The 4-step method

  1. Match KEV against your inventory: vendors, products and versions. A simple script on the JSON feed is enough to start.
  2. Treat matches as top priority, starting with anything internet-facing.
  3. Set an internal deadline: for example 48 hours for exposed devices, a week for internal ones. Apply a workaround in the meantime if the patch lags.
  4. Check new entries weekly, or automate an alert.

Add EPSS on top

KEV only covers confirmed exploitation. To estimate how likely a flaw is to be exploited soon, FIRST's EPSS score is a good complement. In practice: KEV first, high EPSS next, then everything else by CVSS and exposure.

The bottom line

CVSS tells you what could happen; KEV tells you what's already happening. By matching the CISA KEV catalog against your inventory every week, you focus effort where the risk is real.

Follow for a daily dose of network and firewall security.