What it asks for. The KEV catalogue is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with reliable evidence of active exploitation and a clear remediation action. Each entry includes the CVE identifier, affected product, required action and a due date that applies to US federal civilian agencies under BOD 22-01.
In practice. Although binding only on US federal agencies, many organisations worldwide use KEV as a prioritisation input. In practice, vulnerability management tooling flags KEV listed issues automatically and remediation targets for them are shorter than for other findings. Evidence includes patching metrics for KEV entries, exception records and asset inventories complete enough to know where affected products run.
Common gaps. KEV is sometimes treated as the only list that matters, although it covers only a small fraction of exploited issues. Incomplete asset inventories mean affected systems are missed.