CISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks. Most security data describes what could go wrong; this list records what has actually been used against systems, which makes it a good signal for what to fix first.
What is CISA KEV?
CISA KEV is the Known Exploited Vulnerabilities catalog, a public list of vulnerabilities for which there is evidence of exploitation in the real world.
CISA is the Cybersecurity and Infrastructure Security Agency of the United States. It adds a CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. to the catalog when it has reliable evidence of active use by attackers and a clear way to fix or mitigate the flaw. Every entry shows the CVE ID, the vendor and product, a short description and the date it was added.
The catalog was created to give US federal agencies a deadline for fixing the flaws that are being used. Those deadlines do not apply to private companies, but the list itself is public and widely used as a priority guide.
What KEV is not
KEV is not a list of all serious flaws. Many severe vulnerabilities never appear in it, because nobody has shown they were used. A high CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. score and a KEV entry answer different questions: the first says how bad a flaw could be, the second says that it has been used. When a flaw is in both, it moves to the top of the list.
What it means for a PHP or WordPress site
For a site owner, KEV is a quick filter. When you read about a flaw in PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., a server component or a pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. you run, a KEV entry tells you that the clock is already ticking. If there is no entry, you still plan the update, but you may do it in a calmer rhythm, with a stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. test and a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update..
Be careful with the reverse conclusion. A missing entry is not an all-clear. A flaw can be used in the wild before CISA lists it, and CISA can only list what it has seen evidence for. That is also why a flaw in the KEV catalog is not automatically a zero-dayA zero-day is a security weakness that attackers use before the maker has released a fix, so there were zero days to prepare., and a zero-day is not automatically in the catalog.
A concrete example
On 21 October 2026 the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The catalog version of 21 October 2026, released at 14:04 UTC, does not list them. php.net and CISA do not report exploitation in the wild at this time. php.net does mention a demonstrated exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works., which is a proof that the attack works, and that is a different thing from use against real sites. Our PHP2Shell page keeps the current status with sources and check times.
When to act
If a flaw in software you run appears in the catalog, update now, or ask your host or developer when they will. If it is not listed but the maker says to update immediately, follow the maker. Both situations call for the same first step: find out your exact PHP and plugin versions. You can check your PHP version for free to see what your site reveals to the outside.
When the update is not simple, because the site is old, the PHP branchA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. no longer gets fixes or a plugin breaks on the new version, ask for a planned route with our help to fix your WordPress website or update PHP in WordPress.
Frequently asked questions
What does it mean when a vulnerability is in the KEV catalog?
CISA has evidence that attackers have used it in the real world. That moves it from a theoretical risk to a practical one, so if you run an affected product, it is a strong reason to update without delay.
Does a vulnerability that is not in KEV mean nobody is exploiting it?
No. Not being listed only means that CISA has not added it, for example because the evidence is not there yet or has not been reviewed. It does not prove that nobody is using the flaw.
Do I have to follow the KEV catalog as a small business?
The catalog sets deadlines for US federal agencies, and you are not bound by them. Many security teams use it as a practical priority list, and you can do the same.
Where can I check the catalog?
CISA publishes it on cisa.gov as a web page and as a downloadable file. Each entry names the CVE, the product and the date it was added.