Known Exploited Vulnerabilities

A known exploited vulnerability (KEV) is a CVE with credible evidence of exploitation in the wild — not merely a high CVSS score, a public PoC, or a theoretical exploitability claim.

Security teams use KEV status to prioritise remediation: only a small fraction of published CVEs are ever exploited, so exploitation evidence is a stronger signal than severity alone.

For a deeper definition and examples of accepted evidence, see What Is a Known Exploited Vulnerability?.

CISA KEV is the authoritative U.S. government catalog of known exploited vulnerabilities. It is essential — and KEVIntel includes it as a baseline.

KEVIntel goes further with additional exploited-CVE attestations from public reporting, vendor advisories, RSS monitoring, and proprietary honeypot/sensor telemetry, plus confidence scoring, enrichment (EPSS, CVSS, CWE, PoCs), and automation-ready delivery via RSS and API.

Many teams also track exploited CVEs not yet listed in CISA KEV. See the full KEVIntel vs CISA KEV comparison.

Valid attestation sources can include:

• KEVIntel honeypot and sensor evidence of exploitation attempts mapped to a CVE
• Vendor advisories that explicitly state active exploitation or observed attacks
• Official known exploited vulnerability catalogs
• High-trust exploitation reporting and threat intelligence
• Credible public reporting that documents exploitation in the wild

A generic patch advisory, PoC release, scanner template, or exploitability claim alone is not sufficient. Details are in the KEVIntel methodology.

Confidence scoring separates strong exploitation evidence from weaker signals. Levels (Confirmed, High, Medium, Low) weigh source quality, endpoint specificity, payload fidelity, repeat observations, sensor telemetry, public corroboration, and human validation where needed.

Per-CVE evidence is always shown on the CVE detail page. Read more in the confidence scoring methodology.

KEVIntel operates honeypots and sensors that observe exploitation attempts targeting internet-facing services and map activity to CVEs where the signal is sufficiently specific. Counts reflect attempts — not proof that a particular organisation was compromised.

Explore live telemetry on Exploitation Signals.

KEVIntel delivers known exploited vulnerability intelligence through:

• Free KEV RSS Feed — registered accounts get a personal tokenized feed URL (sign up for RSS). CISA KEV itself does not provide RSS — see our CISA KEV RSS alternative.
• Free KEV JSON Feed — summary catalog via GET /api/v2/kevs with an API token after email confirmation.
• Pro and Enterprise APIs — enriched records, telemetry summaries, and (Enterprise) raw observations, virtual patches, and webhooks. See API & Integrations and API docs.