CISA Opens KEV Catalog to External Vulnerability Reports

The Cybersecurity and Infrastructure Security Agency (CISA) has launched a new nomination form, allowing external researchers, vendors, and industry partners to submit vulnerabilities for inclusion in its Known Exploited Vulnerabilities (KEV) catalog. This move, reported by The Record by Recorded Future, broadens the input stream for CISA’s critical list of actively exploited flaws.

Historically, the KEV catalog has been a CISA-curated list, primarily informing federal agencies of urgent patching requirements. Opening it up to the broader security community acknowledges the distributed nature of vulnerability discovery and exploitation intelligence. It’s a pragmatic step to improve the catalog’s comprehensiveness and timeliness.

For defenders, this means the KEV catalog should become an even more robust and current resource. The attacker’s calculus remains the same: find and exploit zero-days or N-days before patches are widely deployed. CISA’s initiative aims to shrink that window by accelerating the identification of exploited vulnerabilities, pushing organizations to patch critical flaws faster.