Skip to content
IACS RadarIndustrial Cyber Exposure & Intelligence

CISA KEV

Known Exploited Vulnerabilities

The KEV catalogue contains vulnerabilities for which CISA has established actual exploitation, with a mandatory remediation deadline for US federal agencies and a strong recommendation for all organisations.

38

Entries

KEV data: live connection— last retrieved: 24 September 2026 at 06:16.

KEV means there is evidence of actual exploitation. A high CVSS score alone does not demonstrate this — see the methodology page for the difference between CVE, KEV and CVSS.

38 KEV entries

KEVPatch available

Added on

22 September 2026

Remediation due

25 September 2026

Ransomware use

unknown

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEVPatch available

Added on

14 September 2026

Remediation due

17 September 2026

Ransomware use

unknown

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEVEnergyPatch available

Added on

9 September 2026

Remediation due

12 September 2026

Ransomware use

unknown

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEVPatch available

Added on

9 September 2026

Remediation due

12 September 2026

Ransomware use

unknown

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEVPatch available

Added on

26 August 2026

Remediation due

29 August 2026

Ransomware use

unknown

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEVNo patch available

Added on

8 June 2026

Remediation due

11 June 2026

Ransomware use

confirmed

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

20 May 2026

Remediation due

3 June 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

20 May 2026

Remediation due

3 June 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

28 April 2026

Remediation due

12 May 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

30 March 2026

Remediation due

2 April 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

5 March 2026

Remediation due

26 March 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

17 February 2026

Remediation due

10 March 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

10 February 2026

Remediation due

3 March 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

10 February 2026

Remediation due

3 March 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

29 December 2025

Remediation due

19 January 2026

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

19 December 2025

Remediation due

26 December 2025

Ransomware use

confirmed

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

17 December 2025

Remediation due

24 December 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

16 December 2025

Remediation due

23 December 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

19 November 2025

Remediation due

10 December 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

24 October 2025

Remediation due

14 November 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

20 October 2025

Remediation due

10 November 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

7 October 2025

Remediation due

28 October 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

6 October 2025

Remediation due

27 October 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

6 October 2025

Remediation due

27 October 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

29 September 2025

Remediation due

20 October 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

23 September 2025

Remediation due

14 October 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

26 August 2025

Remediation due

28 August 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

5 August 2025

Remediation due

26 August 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

5 August 2025

Remediation due

26 August 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVEnergyNo patch available

Added on

10 July 2025

Remediation due

11 July 2025

Ransomware use

confirmed

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVEnergyNo patch available

Added on

30 June 2025

Remediation due

21 July 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

10 June 2025

Remediation due

1 July 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

13 May 2025

Remediation due

3 June 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

17 April 2025

Remediation due

8 May 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

4 April 2025

Remediation due

11 April 2025

Ransomware use

confirmed

Required action: Apply mitigations as set forth in the CISA instructions linked below.

KEVNo patch available

Added on

3 March 2025

Remediation due

24 March 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

3 March 2025

Remediation due

24 March 2025

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEVNo patch available

Added on

10 October 2023

Remediation due

31 October 2023

Ransomware use

unknown

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.