Exploited-vulnerability triage guide

Open one triage record per vulnerability and asset group

CISA calls the KEV catalog an authoritative list of vulnerabilities exploited in the wild and recommends it as one input to prioritization. A KEV entry shows exploitation somewhere, not compromise in your environment.

• Record the CVE, KEV date added and due date, vendor action, source URLs, detection time, and triage owner.
• Use the asset inventory to identify products, exact versions, exposure, business service, data sensitivity, safety impact, and recovery options.
• Mark each asset group Not affected, Susceptible, Compromised, or Unknown, and retain the evidence for that decision.

Separate remediation urgency from incident evidence

Use vendor instructions and facts about your environment to decide treatment. CISA's SSVC model adds exploitation status, technical impact, mission prevalence, and public-wellbeing or safety impact; CVSS alone is not enough.

• If the vulnerable product is absent, preserve the query, inventory timestamp, and version evidence that support Not affected.
• If the product is present, apply the vendor update or mitigation by the risk-based deadline. Track exceptions with an owner and expiry date.
• Search for vendor or CISA indicators and abnormal activity. If you find evidence of exploitation, start incident response. A patch does not remove an intruder.

Close with verification

Re-scan or otherwise verify the fixed build or mitigation, confirm the service is healthy, record residual exceptions, and update the asset inventory. A deployment job succeeding is weaker evidence than a version check and exposure test.

Limits

This is a general workflow. Federal deadlines may not bind private organizations, and the right containment, evidence-preservation, remediation, and disclosure steps depend on the system and incident.

Sources

• CISA Known Exploited Vulnerabilities Catalog
• CISA Stakeholder-Specific Vulnerability Categorization Guide
• CISA Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

The source-check date records editorial review. Routine builds do not advance it.

Revision history

• 2026-09-07 — Published after checking the CISA KEV, SSVC, and response playbooks.