How is KEV different from CVSS?

CVSS scores how severe a vulnerability could be if exploited. KEV confirms a vulnerability is actually being exploited right now. A vulnerability can have a low CVSS score and still be in KEV, or a high CVSS score and never appear in KEV at all.

The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days, based on observed data. It complements KEV by scoring vulnerabilities that aren't confirmed-exploited yet.

Does being listed in KEV mean my organisation is affected?

No. KEV confirms exploitation is happening somewhere. Whether it affects you depends on whether you run the affected vendor and product — which is exactly what Seraph CTI's technology watches are built to determine.

How often is the Seraph KEV catalogue updated?

Seraph CTI syncs directly against CISA's published feed, which CISA typically updates on business days, and against FIRST.org's EPSS scores, which are refreshed daily.

How does Seraph prioritise vulnerabilities?

By layering signals: CISA KEV status, EPSS exploitation probability, known ransomware association, and — for signed-in customers — whether the affected technology is actually in their environment.

Can Seraph CTI notify us when technologies we use are affected?

Yes. Technology watches let you declare the vendors and products your organisation runs, and get notified when a new KEV entry matches your declared stack.

How does KEV intelligence connect to VAPT?

A confirmed-exploited vulnerability in a technology you run is a strong candidate for safe, targeted validation through penetration testing — rather than waiting for the next scheduled engagement to surface it.

How does KEV intelligence support SOC operations?

SOC analysts can correlate KEV entries against live security events, so an exploitation attempt against a known-vulnerable, known-exploited technology is triaged with that context attached from the start.

CISA Known Exploited Vulnerabilities (KEV)

Why KEV Matters

Critical does not always mean exploited.

Thousands of vulnerabilities are disclosed every year. The challenge isn't identifying every vulnerability — it's understanding which ones attackers are actively using, and which of those are relevant to your environment.

CISA KEV answers the first question with authority: every entry is a vulnerability with confirmed, real-world exploitation. Seraph CTI carries that signal the rest of the way to a decision.

1

Vulnerability

A weakness is disclosed.

2

CVSS Severity

How bad could this be, in theory.

3

EPSS Exploitability

How likely is exploitation, in practice.

4

CISA KEV

Confirmed — this one is being exploited.

5

Threat Activity

Which actors and campaigns are using it.

6

Technology Match

Does it touch what you actually run.

7

Priority Action

What to do, and by when.

This is what Seraph CTI automates

Live Intelligence

Explore actively exploited vulnerabilities.

1,685 vulnerabilities match your filters.

CVE	Vendor / Product	EPSS	Date Added	Remediation Due	Ransomware Use	Action
CVE-2020-29574	Sophos CyberoamOS	4.7%	Feb 06, 2025	Feb 27, 2025 Overdue	Known	View
CVE-2020-15069	Sophos XG Firewall	10.7%	Feb 06, 2025	Feb 27, 2025 Overdue	Unknown	View

Page 18 of 68

Previous Next

Understand the Signal

More than a CVE number.

Every KEV entry is a real vulnerability with a real deadline. Here's the most recently added one, shown exactly as Seraph CTI tracks it.

CISA KEV

CVE-2026-66384

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

View Full Intelligence

VendorJFrog

ProductArtifactory

EPSS0.6%

Added to KEVAug 27, 2026

Remediation DueSep 10, 2026

Known Ransomware UseUnknown

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Seraph Context

Technology Watch MatchAvailable for technologies you monitor inside Seraph CTI.

Relevant Threat ActorsSurfaced automatically when a tracked actor is linked to this CVE.

Sector ContextShown when this vendor/product is relevant to your industry.

Exploitation ContextCampaign and indicator context, where Seraph analysts have published it.

From Disclosure to Action

Know how quickly you need to move.

For CVE-2026-66384, added to the catalogue on Aug 27, 2026 with a remediation deadline of Sep 10, 2026.

Added to KEVAug 27, 2026

Seraph AlertSame day

Remediation DueSep 10, 2026

ValidationOngoing

Overdue49 days overdue

Recommended action: Apply vendor remediation guidance.

Seraph Intelligence

From public vulnerability data to security context.

CISA KEV is one intelligence signal — an authoritative one, but a single layer. Seraph CTI enriches it with CVSS and EPSS scoring, exploit availability, threat actor and campaign intelligence, technology relevance, and sector and regional context where evidence exists.

Seraph doesn't just answer “is this being exploited?” — it helps answer “does it matter to us?”

CISA KEV
CVSS + EPSS
Exploitation Intelligence
Threat Actors / Campaigns
Technology Watches
Sector / Regional Context
Priority

Your Environment

Know when a KEV affects technology you actually use.

The public catalogue tells everyone the same thing. Signed-in Seraph CTI customers declare the technologies they run once, and get notified the moment a new KEV entry matches their stack — not the other 1,600 that don't.

Your Technology Watches

Microsoft 365Monitoring
FortinetMonitoring
VMwareMonitoring
CiscoMonitoring
CitrixMonitoring

IllustrativeNew Match

CVE-XXXX-XXXXX

CISA KEVHigh EPSSKnown Exploitation

Technology MatchFortinet FortiOS

Review Intelligence

Monitor Your Technology Stack

Exploitation Trends

What attackers are exploiting.

Computed live from the full tracked catalogue — not a static snapshot.

KEVs Added by Month

Is exploitation activity accelerating?

Nov

Dec

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Top Affected Vendors

Whose products need the most attention?

Microsoft

386

Cisco

96

Apple

94

Adobe

80

Google

72

Oracle

46

Apache

40

Ivanti

35

EPSS Score Distribution

How exploitable is the average KEV entry?

0–20%

20–40%

40–60%

60–80%

80–100%

Based on 1,685 entries with a published EPSS score.

Ransomware-Associated

How many KEVs are tied to known ransomware use?

21%of tracked KEVs have known ransomware campaign use

Avg. Remediation Window

How long between listing and deadline?

43average days from KEV addition to CISA's deadline

Sector Relevance

Understand which vulnerabilities matter to your industry.

Not every KEV entry carries the same weight in every sector. Seraph CTI flags vulnerabilities relevant to the technologies commonly used across identity, network/edge, server and cloud infrastructure in a given industry.

Financial ServicesHealthcareGovernmentTechnologyProfessional Services

Seraph describes vulnerabilities as relevant to technologies commonly used in a sector — never as evidence that a specific CVE is actively targeting it, unless that targeting has been independently confirmed.

Regional Intelligence

Global exploitation. Regional relevance.

Where evidence supports it, Seraph CTI adds regional context — technology relevance, observed exploitation, sector exposure, threat actor activity and reported campaigns specific to East Africa.

No verified regional exploitation context is currently available for the public catalogue shown on this page. Seraph CTI customers see regional context directly against their own monitored environment.

One Signal. Multiple Security Actions.

KEV intelligence should not stop at the catalogue.

Threat intelligence is the layer that connects every other layer of defence. A single KEV entry flows across the Seraph platform, not just into a report.

CISA KEV

Seraph
CTI

Exposure

Determine whether affected assets exist in the organization.

Pentest

Safely validate relevant vulnerabilities where appropriate.

SOC

Correlate exploitation intelligence with security events.

Remediation

Compliance

Track remediation, risk and control obligations.

CISA KEV

Seraph CTI

Exposure

Determine whether affected assets exist in the organization.

Pentest

Safely validate relevant vulnerabilities where appropriate.

SOC

Correlate exploitation intelligence with security events.

Remediation

Compliance

Track remediation, risk and control obligations.

From Intelligence to Action

A KEV entry should trigger a decision, not another alert.

Check Exposure
Determine whether affected technologies exist in your environment.
Understand the Threat
Review exploitation activity, threat context and asset importance.
Prioritise Remediation
Escalate vulnerabilities that represent material organisational risk.
Validate
Confirm remediation and continue monitoring.

Recently Added

Latest additions to the KEV catalogue.

Explore all KEVs

KEV

CVE-2026-66384

JFrog — Artifactory

Added Aug 27, 2026EPSS 0.6%

KEV

CVE-2026-53362

Linux — Kernel

Added Aug 27, 2026EPSS 0.5%

KEV

CVE-2023-49105

ownCloud — ownCloud

Added Aug 27, 2026EPSS 43.2%

KEV

CVE-2019-1068

Microsoft — SQL Server

Added Aug 26, 2026EPSS 52.8%

KEV

CVE-2026-8452

Citrix — NetScaler ADC and NetScaler Gateway

Added Aug 26, 2026EPSS 1.6%

KEV

CVE-2022-0995

Linux — Kernel

Added Aug 26, 2026EPSS 9.5%

Frequently Asked Questions

Questions about KEV, EPSS and Seraph intelligence.

Can't find what you need? Ask a security expert.

KEV is a public catalogue maintained by the US Cybersecurity and Infrastructure Security Agency, listing vulnerabilities with confirmed evidence of active, real-world exploitation — not just theoretical risk.

Track the vulnerabilities attackers are actively exploiting.

Critical does not always mean exploited.

Vulnerability

CVSS Severity

EPSS Exploitability

CISA KEV

Threat Activity

Technology Match

Priority Action

From public vulnerability data to security context.

Know when a KEV affects technology you actually use.

CVE-XXXX-XXXXX

Understand which vulnerabilities matter to your industry.

Global exploitation. Regional relevance.

KEV intelligence should not stop at the catalogue.

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

A KEV entry should trigger a decision, not another alert.

Check Exposure

Understand the Threat

Prioritise Remediation

Validate

Questions about KEV, EPSS and Seraph intelligence.

Know when actively exploited vulnerabilities affect your environment.

Track the vulnerabilities attackers are actively exploiting.

Critical does not always mean exploited.

Vulnerability

CVSS Severity

EPSS Exploitability

CISA KEV

Threat Activity

Technology Match

Priority Action

Explore actively exploited vulnerabilities.

More than a CVE number.

CVE-2026-66384

Know how quickly you need to move.

From public vulnerability data to security context.

Know when a KEV affects technology you actually use.

CVE-XXXX-XXXXX

What attackers are exploiting.

KEVs Added by Month

Top Affected Vendors

EPSS Score Distribution

Ransomware-Associated

Avg. Remediation Window

Understand which vulnerabilities matter to your industry.

Global exploitation. Regional relevance.

KEV intelligence should not stop at the catalogue.

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

CISA KEV

Exposure

Pentest

SOC

Remediation

Compliance

A KEV entry should trigger a decision, not another alert.

Check Exposure

Understand the Threat

Prioritise Remediation

Validate

Latest additions to the KEV catalogue.

CVE-2026-66384

CVE-2026-53362

CVE-2023-49105