MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesQuality SystemKEV

    CISA Known Exploited Vulnerabilities Catalog

    CISA catalog of vulnerabilities exploited in the wild, with risk-prioritization requirements for covered federal systems.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

    Definition

    The KEV Catalog lists CVEs with evidence of exploitation in the wild and actionable remediation guidance. Entries include affected products, date added, required action, due date, ransomware-use status and, where applicable, forensic-triage requirements. As of November 1, 2026, applicable federal requirements are governed by BOD 26-04, which superseded BOD 22-01 on June 10, 2026. Consult current directive requirements and each entry rather than assuming a universal 21-day deadline.
    What the regulation says
    BOD 26-04 governs covered federal civilian executive branch systems, not private hospitals generally. Section 524B(b)(1) requires applicable cyber-device sponsors to submit a postmarket monitoring and response plan including coordinated vulnerability disclosure. Section 524B(b)(2)(B) addresses out-of-cycle patches as soon as possible for critical vulnerabilities that could cause uncontrolled risks. KEV is useful supporting intelligence, not a statutory device-specific risk classification.

    What this means in practice

    For device manufacturers, cross-reference KEV against component inventories and SBOMs, then assess affected versions, configuration, exploitability, patient impact and mitigations. KEV complements rather than replaces risk analysis.

    Examples

    • Illustrative: A MedTech manufacturer discovered that a third-party library used in their medical device firmware was listed in the KEV Catalog, prompting them to immediately prioritize patching the vulnerability across their deployed fleet.
    • Illustrative: During a routine security audit, a hospital IT team checked their inventory of connected medical devices against the KEV Catalog to identify any critical vulnerabilities requiring urgent remediation.
    • Illustrative: A security researcher notified a device vendor that a vulnerability they had privately disclosed was later added to CISA's KEV, accelerating the vendor's timeline for releasing a security update.
    Common pitfalls
    • •Treating CVSS score as a substitute for KEV status, many critical-CVSS bugs are never exploited; many medium-CVSS bugs on KEV are devastating.
    • •Polling KEV manually instead of automating ingestion of the official JSON feed and cross-referencing it with your SBOM.
    • •Do not assume federal KEV deadlines bind private hospitals or manufacturers. Assess applicable contracts and device-specific risk separately.

    Frequently asked questions

    Three criteria must all be met: the vulnerability has a CVE ID, there is reliable evidence of active exploitation in the wild, and there is clear remediation guidance (usually a vendor patch).

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Latest in MedTech

    Sources

    6 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Official-source claim check:

    CISA maintains a catalog of vulnerabilities exploited in the wild; it is a prioritization input, not proof of exploitability in every device.

    Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

    Remaining verification limits
    • Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
    Tier 2Regulator guidance and consensus· 6
    Link health: 3 verified 3 unchecked· last checked 2026-06-20
    CISA·5FDA·1
    1. 1
      Known Exploited Vulnerabilities Catalog
      Tier 2 Verified
      CISAcisa.gov
    2. 2
      Binding Operational Directive 22-01
      Tier 2 Verified
      CISAcisa.gov
    3. 3
      KEV JSON feed
      Tier 2 Verified
      CISAcisa.gov
    4. 4
      CISA BOD 26-04
      Tier 2 Unchecked
      CISAcisa.gov
    5. 5
      CISA revoked BOD 22-01
      Tier 2 Unchecked
      CISAcisa.gov
    6. 6
      FDA final guidance, February 3, 2026
      Tier 2 Unchecked
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.