Journal / Method

KEV · 9 Nov 2026

Read the due date before you read CVSS.

The Known Exploited Vulnerabilities catalog is a list of bugs CISA says are already in use. It is a sort key. It is not a write-up, and it is not a score.

What a row actually claims

A KEV entry means CISA accepted evidence that the vulnerability is being exploited. It does not mean the bug is in your network. It does not mean every version of the product is exposed. It does not rank the bug against next week's critical CVSS 10 that nobody is using.

That is why this desk does not print CVSS on the board. A 5.5 that is in the catalog outranks a 10.0 that is not, for the only question the catalog answers: what to patch first among things already being used.

The date is a federal deadline

The due date binds US federal civilian agencies. CISA's own 3 November alert describes BOD 26-04 as the directive that tells those agencies to prioritize KEV entries on exposed assets, especially where exploitation gives total control, and to check whether the system was compromised before the patch. The directive does not bind a private company. The date is still the least theatrical way to order the work.

On this snapshot, 9 November 2026, six rows in the working set are still inside that window. Thirty-two are already past it. Past due means the federal clock ran out. It does not mean the bug retired.

Two flags that change the job

  • Forensic triage. Patching is not the whole task. Someone may have used the bug before the package landed. The check is for compromise, not only for the version string.
  • Ransomware. In this working set the flag sits on one row: CVE-2026-59310, VMware vCenter, added 18 August 2026. One flag in ninety days is not "ransomware is quiet." It is "this row does not wait behind a VPN bug you might not run."

Order of work

  1. Match the product you run, not the vendor's marketing name. "We have Cisco" is not a match.
  2. If you do not run it, close the row. Do not write an assessment.
  3. Read the due date and the triage flag.
  4. Open the vendor advisory for the build number. This desk does not copy build numbers it has not verified against that advisory.
  5. If triage is set, schedule a look for prior use in the same change as the patch. A version bump with no one reading logs is how a late patch gets counted as done.

What you will not find under the row

No request, no parameter, no chain, no sample. The class sentence is the public shape of the bug. The useful next page is the vendor's, or one of the three November notes linked from the board when the class needs a paragraph.