// tool reference · Vulnerability & Assessment

CISA KEV Checker Free

CVE が CISA の Known Exploited Vulnerabilities（既知の悪用された脆弱性）リストに掲載されているか、いつまでにパッチを適用すべきかを確認します。

Open CISA KEV Checker →

What it does

Answers one question fast: is this being exploited in the wild? KEV membership should dominate your patch order.

When to use it

Deciding what to patch this week. A KEV entry outranks a higher CVSS that nobody is exploiting.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
cve	text	required	CVE ID.

What you get back

KEV status, date added, and the remediation due date.

活用例

Input

CVE-2026-0001

Output (abridged)

NOT ON KEV

  No confirmed in-the-wild exploitation is recorded by CISA.

  This is NOT 'safe'. KEV is a LAGGING indicator -- it records what has
  been observed and reported. Absence means 'not yet catalogued', not
  'not exploitable'.

  Use KEV to ESCALATE, never to defer. A KEV hit is a hard signal to
  patch now; a KEV miss is not permission to wait.

How it works

Deterministic lookup against the CISA KEV catalog.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

KEV is a lagging, US-federal-scoped catalogue. Absence proves nothing. Never use a KEV miss as a reason to defer patching.

プライバシー

Nothing is stored.

Standards

CISA KEVBOD 22-01