Known Exploited Vulnerabilities

The CISA Known Exploited Vulnerabilities (KEV) catalogue is the primary operational mechanism for communicating mandatory patch obligations to Federal Civilian Executive Branch (FCEB) agencies and urgency signals to private-sector organisations. The KEV catalogue was established under CISA's Binding Operational Directive 22-01 in November 2021. FCEB agencies must remediate KEV CVEs within specified windows: typically 14 days for non-critical and 2-7 days for critical, with Emergency Directives applying the shortest windows to the highest-severity active exploitation cases. Private-sector organisations are not bound by BOD 22-01 but treat KEV addition as the strongest available public signal of active exploitation, and it is the data feed that drives patch-prioritisation tooling in Qualys, Tenable, Rapid7, and most major vulnerability management platforms.

In the 30-day window covered by the first cyber-threats update (April 2026), CISA added nine CVEs including CVE-2026-3055 (CitrixBleed 3), CVE-2025-53521 (F5 BIG-IP APM, reclassified to CVSS 9.8 RCE), CVE-2009-0238 (17-year-old Microsoft Office RCE), CVE-2026-21643 (Fortinet SQL injection), and CVE-2026-32201 (SharePoint spoofing zero-day). In April 2026, 16 new CVEs were added, including three Cisco Catalyst SD-WAN Manager CVEs added on 20 April with a 3-day federal remediation deadline, the shortest observed window in the current cycle.

A structurally significant pattern has emerged across three KEV additions in twelve days in May 2026: CISA imposed federal compliance obligations before vendor patches were available. PAN-OS CVE-2026-0300 was added on 6 May with a 9 May federal deadline, four days before Palo Alto's own patches shipped. Cisco SD-WAN CVE-2026-20182 (CVSS 10.0) was added on 14 May with a 17 May deadline, and Exchange Server CVE-2026-42897 was added on 15 May with a 29 May deadline while Microsoft had not shipped a patch. The first instance read as forced by exploitation Velocity; the repeat reframes it as posture: CISA is willing to write a federal deadline against an unpatchable flaw twice in twelve days. For enterprise patch-management teams, this places BOD 22-01 in operational tension with its own remediation framework: a federal compliance obligation that no remediation step satisfies requires mitigation-plus-monitoring responses that the directive does not formally specify.

For context, the catalogue's obligations have grown while the agency responsible for maintaining and enforcing them faces a proposed $707m CISA cut affecting 860 staff, a budget constraint that reduces the agency's capacity to sustain the advisory quality and frequency the KEV's signal value depends on.