Definition
Known Exploited Vulnerabilities
A known exploited vulnerability (KEV) is a Common Vulnerabilities and Exposures (CVE) identifier with credible evidence of attempted or successful exploitation in the wild.
Published in the Previdian glossary and the Previdian methodology.
What Counts as Evidence
Previdian treats a CVE as a known exploited vulnerability when attestation sources document known exploitation. Valid sources can include:
- Previdian honeypot and sensor evidence of exploitation attempts mapped to a CVE
- Vendor advisories that explicitly state active exploitation or observed attacks
- Official known exploited vulnerability catalogs
- High-trust exploitation reporting and threat intelligence
- Credible public reporting that documents exploitation in the wild
A generic patch advisory, public PoC, scanner template, or exploitability claim alone is not enough. Full rules are in the Previdian methodology.
How a honeypot records an attempt, on a real application or a decoy, is explained in Attempted and Successful Exploitation.
CISA KEV and Beyond
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains an official Known Exploited Vulnerabilities catalog. It is authoritative and valuable — and Previdian includes it.
Previdian also tracks additional exploited vulnerabilities not yet in CISA KEV, with confidence scoring, enrichment, RSS delivery, and proprietary sensor telemetry. See Previdian vs CISA KEV and the CISA catalog page on this site.
Common Questions
- What is a known exploited vulnerability?
- A known exploited vulnerability (KEV) is a Common Vulnerabilities and Exposures (CVE) identifier with credible evidence of attempted or successful exploitation in the wild.
- What evidence counts?
- Previdian honeypot and sensor evidence of exploitation attempts mapped to a CVE. Vendor advisories that explicitly state active exploitation or observed attacks. Official known exploited vulnerability catalogs. High-trust exploitation reporting and threat intelligence. Credible public reporting that documents exploitation in the wild.
- What is not enough on its own?
- A generic patch advisory, public PoC, scanner template, or exploitability claim alone is not enough.
- How is CVSS different?
- Describes how bad a flaw could be — not whether attackers are using it.
Browse the Live Feed
The live list of known exploited vulnerabilities tracked by Previdian, with confidence, CISA status, and sensor flags, is on the KEV feed.