What a cyber underwriter checks when CISA adds a KEV listing
Quick answer, Oct 28, 2026As of 28 October 2026, a CISA KEV listing gives a cyber underwriter four checks: whether the policyholder's estate runs the affected product, whether it is at or above the fixed version, whether CISA's due date has passed, and whether ransomware use is recorded. Our desk notes set these out per listing, with sources.
The four checks
- Is the product in the estate? The listing names vendor and product.
- Is it at or above the fixed version? The CVE record names fixed versions.
- Has the federal due date passed? CISA sets a remediation due date for federal civilian agencies; use it as a benchmark for time-to-patch, not as a rule for policyholders.
- Is ransomware use recorded? The catalog states whether known ransomware use is recorded.
Add FIRST's EPSS estimate to rank the vulnerabilities that are not yet listed (see KEV vs EPSS).
Example
Recent desk notes on KEV additions, such as Arista VeloCloud Orchestrator SQL injection (23 October 2026), Collabora Online CODE Server command injection and Fortinet FortiMail path traversal, each put the official record next to what it means for the reader it is written for and what would change the call, with numbered sources.
What a note will not do
It will not price a risk or decide coverage. Where the record is silent or still moving, the note says so.
Get notes where you work
Filter the desk by reader (cyber underwriter), subscribe to the feed, or have an AI assistant read them through the MCP server with search_notes and get_note.
Questions
Does the desk cover every KEV addition? The desk covers the additions we judge decision-relevant; the MCP search_kev tool covers the full catalog.