Grey Noise analysis on researching with the CISA KEV.
Summary: GreyNoise reviewed CISA's Known Exploited Vulnerabilities catalog more than six months after its November 2021 launch, counting 38 releases covering 777 CVEs against 11,099 new CVEs assessed by the National Vulnerability Database in calendar year 2022 as of June 14. GreyNoise held tags for 161 of the KEV CVEs, about 20%, and observed activity in the prior seven days for 59 of those tags, with a recent Atlassian Confluence exploit topping the activity.
Key Takeaway: GreyNoise could only confirm exploitation activity for 59 of the 777 cataloged CVEs in a seven-day window, so a KEV listing tells you a vulnerability was exploited at some point, not that it is being exploited against you now. The author's own grades - a C for missing metadata and a C for old entries added without context - mean the list grows while the filtering help defenders need to act on it does not.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026