Known exploited vulnerabilities, daily

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is the US Cybersecurity and Infrastructure Security Agency's list of software flaws with reliable evidence of exploitation in the wild. Under Binding Operational Directive 26-04, which replaced BOD 22-01 on 10 June 2026, US federal civilian agencies must fix each listed flaw by its due date. For most flaws CISA has added since then, the deadline is three days after listing; for the rest, two weeks. Everyone else can use it as a free, evidence-based patch priority list: if a flaw is on KEV, attackers are already using it.

Source: CISA KEV catalog · BOD 26-04 · Catalog version 2026.11.13

For organisations in India

KEV deadlines bind US federal agencies only, but a listing means attackers are already using the flaw, so treat it as a patch-now signal. If one of these products in your organisation was compromised, CERT-In's directions of 28 April 2022 require service providers, intermediaries, data centres, companies and government organisations to report specified incidents within 6 hours of noticing them. How to report an incident to CERT-In.