Known Exploited Vulnerabilities
CISA's catalogue of CVEs confirmed as actively exploited; mandatory patch deadlines for US federal agencies.
On 2 September, Known Exploited Vulnerabilities recorded 37 new entries, 24 with three-day federal remediation deadlines. The catalogue remains CISA's operational list of software flaws confirmed under active exploitation.
Last refreshed: 22 September 2026 · Appears in 1 active topic
Is the 2022 patch or the 2024 patch the one breaking into networks right now?
Timeline for Known Exploited Vulnerabilities
Received five 2015-2023 CVEs with 11 October deadlines
Cybersecurity: Threats and Defences: Ten agencies name Beijing firm in hacksReceived 43 additions in September
Cybersecurity: Threats and Defences: CISA set three-day deadlines on 34 flawsMentioned in: Cisco reaches 100 entries on CISA's list
Cybersecurity: Threats and DefencesMentioned in: Citrix replaces its own NetScaler fix
Cybersecurity: Threats and DefencesMentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesBackground
Known Exploited Vulnerabilities is CISA's catalogue of Common Vulnerabilities and Exposures entries confirmed as actively exploited. Its addition of a flaw starts mandatory remediation deadlines for US Federal Civilian Executive Branch agencies, while private-sector defenders use it as a high-confidence public signal that patching has become urgent. On 10 June 2026, the catalogue had reached 1,627 entries.
The catalogue was established under Binding Operational Directive 22-01 in November 2021. That directive made deadlines part of federal vulnerability management, rather than leaving agencies to rank known flaws solely by severity scores. A 15 May 2026 listing involving Microsoft Exchange showed the practical consequence: agencies received a mandatory Deadline while no vendor patch was available.
On 10 June 2026, Binding Operational Directive 26-04 replaced the former fixed regime with four risk-based remediation windows. The catalogue's lasting importance is therefore twofold: it identifies exploitation that has crossed from theoretical risk into observed threat activity, and it translates that evidence into a federal timetable for action.
KEV deadlines stayed at three days
On 2 September 2026, CISA had added 37 vulnerabilities to Known Exploited Vulnerabilities since 3 August. Twenty-four, or 65 per cent, carried a three-day Deadline for federal agencies. That share had fallen from 87 per cent in the preceding period, but the typical deadline remained three days.
For the catalogue, the change shows that its urgency signal now varies within a batch rather than moving in one direction. On 10 June 2026, Binding Operational Directive 26-04 replaced the earlier fixed approach with risk-based windows of three, 14 or 60 days, or the next upgrade cycle. Known Exploited Vulnerabilities therefore remains both a record of active exploitation and the mechanism that starts federal remediation obligations.
KEV exposes old patch debt
On 14 April 2026, CISA added CVE-2009-0238, a 17-year-old Microsoft Office flaw, to Known Exploited Vulnerabilities after confirming active exploitation. The listing turned a legacy-software weakness into a current federal remediation matter.
On 14 July 2026, the catalogue reached 1,638 entries after CISA added seven flaws, including an 18-year-old Cisco router vulnerability with a fix available since 2008. For Known Exploited Vulnerabilities, such additions show why catalogue inclusion cannot be treated as a measure of software age or novelty. It records evidence that attackers are using a flaw now, including flaws organisations may have long assumed were settled.