The Known Exploited Vulnerabilities catalog changed how security teams should prioritize CVEs. Here is how to build your alerting strategy around it.
The average security team receives hundreds of CVE alerts per week. The average CVE has a CVSS score of 7.something. Almost none of them get exploited in the wild. The ones that do? They appear in the CISA Known Exploited Vulnerabilities catalog before your scanner fires. Here is how to restructure your alerting strategy around KEV as your primary signal.
CISA's Known Exploited Vulnerabilities catalog is a curated list of CVEs for which CISA has reliable evidence of active exploitation in the wild. It is not a list of severe CVEs. It is not a list of CVEs with high CVSS scores. It is a list of CVEs being used against real targets right now.
As of mid-2026, the catalog contains roughly 1,200 entries. Out of 250,000+ published CVEs in the NVD, that is less than 0.5%. And yet that 0.5% represents the overwhelming majority of breach entry points.
For US federal civilian agencies, addressing KEV entries within specific timeframes is a compliance requirement (BOD 22-01). For everyone else, it is just good security hygiene - but treated as such by almost no one.
CVSS measures the theoretical severity of a vulnerability under ideal exploitation conditions. It does not measure whether anyone is actually exploiting it. It does not consider your specific software stack, exposure level, or network architecture.
The result: a CVSS 9.8 vulnerability in a dependency your application never calls in a code path that is never executed gets the same priority as a CVSS 9.8 vulnerability in your authentication middleware that handles 10,000 requests per minute.
Teams that sort by CVSS score are sorting by theoretical risk, not actual risk. The vast majority of high-CVSS CVEs are never weaponized. The teams chasing them are burning time that should be spent on the small number that are.
The right mental model is a two-tier system:
Tier 1 - KEV alerts: Any CVE that appears in the CISA KEV catalog and affects your stack is an immediate action item. No CVSS threshold. No severity filter. If CISA has confirmed active exploitation and the vulnerable component exists in your environment, the patch window is measured in hours, not sprint cycles.
Tier 2 - CVSS-filtered alerts: After KEV alerts are handled, apply CVSS filtering to your remaining CVE backlog. Most teams use a threshold of 7.0 (High and Critical). The goal is not zero alerts - it is actionable alerts at a volume your team can actually process.
This structure reduces alert volume dramatically. If your monitoring tool is surfacing everything with CVSS > 4.0, you are looking at hundreds of alerts per week, most of which will never matter. A KEV-first approach surfaces 5-10 alerts per week that reliably do.
Outrightly syncs the CISA KEV catalog every two minutes. Every CVE in the KEV catalog is tagged with a KEV badge across the feed and on CVE detail pages.
For Pro users with stack monitoring active: KEV-tagged CVEs that match your stack bypass your configured severity threshold entirely. Even if you have configured your alert channel to only notify on Critical (CVSS 9.0+), a KEV match at any severity fires a real-time alert immediately.
This reflects a deliberate choice: we believe that active exploitation status is a more reliable signal than CVSS score, and we want the alert architecture to reflect that belief. You should not have to configure your way into KEV priority - it should be the default.
If you are setting this up from scratch:
1. Get your dependency inventory current. You cannot match CVEs against packages you don't know you're running. GitHub Sync, file upload, or manual stack entry - pick one and do it today.
2. Configure a dedicated KEV alert channel. Your general CVE digest can go to email. KEV alerts for your production stacks should go to Slack or PagerDuty with an on-call rotation.
3. Set a response SLA for KEV matches. This does not need to be formal - it can be a team agreement. We recommend: acknowledge within 1 hour, remediation plan within 4 hours, patch deployed within 24 hours for production systems.
4. Review the full KEV catalog quarterly. It is 1,200 entries and takes 30 minutes to read through. Understanding what gets added and why is one of the highest-ROI security activities available to a small team.
Takeaway
The CISA KEV catalog is the closest thing the security community has to a reliable ground truth on what is being exploited. Building your alerting strategy around it - rather than around CVSS scores - is the single highest-leverage change most security programs can make. Everything else is optimization.