CISA KEV Tracker

1. 01

   Sourced

   Entries come from CISA’s Known Exploited Vulnerabilities catalog, the machine-readable feed the agency publishes itself. The vendor, product, description and required action are CISA’s wording, not a paraphrase; a vulnerability CISA has not listed does not appear here however widely it is discussed.

2. 02

   Dated

   Each row carries the date CISA added it and the remediation date CISA set for it. Both are the agency’s dates, and the gap between them is CISA’s judgment of urgency rather than ours.

3. 03

   Re-checked

   The catalog is re-read weekly and the page rebuilt from it. Entries CISA revises are updated in place; entries CISA removes are removed here.

Why use this instead of CISA’s own page?

For a single lookup, use CISA. This page exists for the questions the catalog does not answer on its own: how the year’s additions distribute across vendors, how long a remediation window actually is, and how many entries carry a confirmed ransomware link. The rows are CISA’s; the summary is what we add.

What does the remediation deadline mean for me?

Legally, nothing unless you are a US federal civilian agency: the deadlines bind them under a binding operational directive. For everyone else it is a signal of how seriously the agency treats a flaw, not a schedule you inherit.

Why is ransomware use often “unknown”?

Because that is what CISA records. Unknown means the agency has not established a ransomware link, not that it has ruled one out, and this page keeps the distinction rather than reporting only the confirmed cases.

This is informational content, not patching guidance for your environment. CISA’s remediation deadlines bind US federal civilian agencies; they are not a statement about your own risk or priority. Prioritize using the linked advisory, the vendor’s own fix, and your asset inventory.

Quoting a figure with a link to this page needs no permission. Cite it as you would any source. Reuse of the compiled dataset itself is licensed under CC BY 4.0: credit SQ Magazine and link back.