How to read a CISA Known Exploited Vulnerabilities entry

Start here · the ten-year-old version

Imagine a school keeping a list of doors with broken locks that people have actually used to get inside. The list is a reason to check your doors. It is not proof that someone entered your classroom.

A vulnerability is a security weakness. A CVE identifier is a reference label for a vulnerability, not a severity score. The KEV schema records it separately from the vendor and product. ² CISA's Known Exploited Vulnerabilities catalog, or KEV, records vulnerabilities reported as exploited. ¹ A useful first question is: do we use the product named in this entry?

SIGNAL · what the catalog records

This is a reference explainer, not a report of a new incident. CISA publishes its catalog as JSON and CSV, with a schema describing the fields. Its official repository mirrors that catalog. ¹

The schema has separate fields for the vendor or project, product, CVE identifier, catalog addition date, required action and due date. Read dateAdded as the date of inclusion in KEV; the schema does not define it as the discovery date. ²

CHECK · FIELD GUIDE for read-only operator review

The following is a suggested investigation workflow, not a quoted CISA procedure or case-specific remediation. Read an existing asset inventory or the product's version information without changing its configuration. Which assets use the named product? Then consult the current vendor advisory to check affected versions and applicable guidance. The product field alone does not provide those version checks.

Use the CVE identifier to join records. Keep catalog metadata alongside the source URL and the time you retrieved it. Read the required action in context instead of turning every entry into the same patch command.

The schema describes knownRansomwareCampaignUse using Known and Unknown. Unknown means CISA lacks confirmation of ransomware use; it does not mean the vulnerability is safe. ²

IMPACT · what the entry cannot establish

A catalog row is not a scan of your systems. It does not establish your exposure or prove compromise. A product-name match needs version and deployment checks. A missing match is not a general security guarantee.

NoobNode's PULSE severity is its own prioritization heuristic, not a CVSS score or a score supplied by CISA. An official-source report and an independently checked remediation are different editorial states. Treat both the source and your own environment as things to verify.

VERIFY · record the result

For a catalog record you are reviewing, compare the CVE identifier, vendor or project, product and dateAdded against the same official source snapshot. Record PASS only if all four values match; record FAIL if a value is missing or different. This is a deterministic record-matching check, not a test of whether a system is vulnerable.

For your own systems, record the installed version and the vendor advisory used to assess it. If that evidence is missing, mark applicability UNKNOWN. A matching product name alone is not a PASS for safety. Keep the source URL, retrieval time and unanswered questions with the result.