A CVE listed in CISA KEV sits in your internet-facing proxy, rated medium - what do you do?

## What a known-exploited listing actually asserts CISA's Known Exploited Vulnerabilities (KEV) catalog is not a severity list and not a forecast. An entry means three things have been established: the flaw has a CVE identifier, there is **reliable evidence of active exploitation in the wild**, and there is a **clear remediation action** - a vendor update, or a mitigation such as discontinuing use of the affected product. Entries carry a required action and a due date; under the US binding operational directive that created the catalog, federal civilian agencies must remediate by that date, and a great many private organisations have adopted the same catalog as a de-facto floor because it is short, curated and free. The distinction that matters in an interview: a severity rating describes the flaw, a likelihood model **predicts** attacker behaviour, and a KEV listing **records** it. Evidence outranks both a rating and a forecast. ## Why the medium band is the least interesting field on the row A severity band is computed from the flaw's intrinsic properties. It cannot know that exploit code is circulating, that it is wired into commodity tooling, or that scanning for this exact endpoint started last Tuesday. A flaw can be rated medium because, say, its individual impact is bounded, and still be the single most-used foothold on the internet this month because it is trivially automatable and sits in software that is everywhere. Ranking your queue by the printed band alone puts that item behind a pile of high-rated flaws nobody has ever attempted. ## The position and the asset This component is an internet-facing proxy. That sets the attacker position at its worst case: **an anonymous internet user, unauthenticated, with no prior access**, who needs no social engineering and no insider. The assets behind it are the availability of everything it fronts and the session credentials passing through it. There is no queueing argument that survives "observed exploitation, anonymous reachability, credentials in transit". ## What you actually do, in order 1. **Confirm applicability.** The catalog names a product and a flaw; you still have to establish that the version you run is in the affected range and that the affected feature is compiled in or enabled. Skipping this leads to emergency changes that fix nothing. 2. **Read the required action.** The catalog entry states what remediation means for this flaw. Sometimes it is a patch; sometimes the stated action is to stop using the product, which is a very different conversation and needs to start immediately. 3. **Remediate or mitigate now.** Patch to a fixed version, or apply the vendor's documented mitigation. On an edge component, a mitigation that removes reachability - disabling the affected feature, blocking the request shape upstream - is a legitimate stopgap while the upgrade is scheduled. 4. **Record a dated exception if you cannot.** An exception with an owner and an end date is a decision. An untracked delay is a gap that nobody will find again. 5. **Assume it may already have happened.** Observed exploitation elsewhere means the retrospective question is real: hand the indicators to whoever owns detection and incident response so they can look backwards, not just forwards. ## Where a vendor's own rating fits You will frequently find the affected vendor's advisory rating the flaw lower than a national vulnerability database does, or the reverse. Neither number changes what the catalog asserts. Decide once, as policy, which source your remediation clock is written against - most teams pick the higher of the available ratings and treat the vendor's number as context - and stop relitigating it per finding. For a known-exploited item the question is moot anyway: membership, not the band, sets the clock. ## The trap on the other side Absence from the catalog is **not** evidence that a flaw is not exploited. The catalog only lists what has been observed, reported, confirmed and paired with a remediation path; it is deliberately small and inevitably lags. Treating it as a filter - "not in the catalog, so it waits" - turns a floor into a ceiling. It is the strongest promotion signal you have and the weakest possible demotion signal.