Cybersecurity definition
What is KEV?
KEV stands for Known Exploited Vulnerabilities.
By Cyber Tool Stack Editorial TeamUpdated
Definition
A catalog, maintained by the U.S. Cybersecurity and Infrastructure Security Agency, of vulnerabilities confirmed to be actively exploited by attackers — a fast, evidence-based way to prioritize patching over relying on severity scores alone.
Where KEV fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
CVECommon Vulnerabilities and ExposuresA public catalog that assigns a unique identifier to a specific, publicly known software or hardware vulnerability, so vendors, researchers, and tools can all refer to the same flaw unambiguously.CVSSCommon Vulnerability Scoring SystemAn industry-standard formula for scoring how severe a vulnerability is, producing a 0-10 number from factors like how easily it can be exploited and what an attacker gains. The current major version, CVSS 4.0, added metrics for real-world threat activity and automatability that earlier versions lacked.EPSSExploit Prediction Scoring SystemA data-driven score estimating the probability that a specific vulnerability will actually be exploited in the wild within the next 30 days, meant to be used alongside CVSS severity rather than in place of it when deciding what to patch first.