> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/risk-and-priortization/cisa-kev.md).

# CISA KEV

Harness STO helps you prioritize security issues based on real-world exploitation risk. For issues with a [Common Vulnerabilities and Exposures (CVE)](https://www.cve.org/) identifier, STO shows whether the CVE appears in the [CISA Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Use this signal on the **Issues** page and **Vulnerabilities** tab to focus remediation on CVEs [CISA](https://www.cisa.gov/) has confirmed are actively exploited.

{% hint style="info" %}

* **Feature flag:** This feature is behind `STO_ISSUE_KEV`. Contact [Harness Support](mailto:support@harness.io) to enable it.
* **CVE requirement:** CISA KEV applies only to issues with a CVE ID.
* **Catalog updates:** CISA updates the catalog several times per week. STO refreshes each CVE's KEV status from the latest catalog snapshot.
  {% endhint %}

### What is CISA KEV? <a href="#what-is-cisa-kev" id="what-is-cisa-kev"></a>

The U.S. [Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/) publishes a catalog of vulnerabilities with evidence of active exploitation. When a CVE appears in [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CISA has confirmed active exploitation in the wild.

### What STO shows <a href="#what-sto-shows" id="what-sto-shows"></a>

STO exposes a single **Yes** or **No** signal for each CVE-associated finding:

* **Yes:** The CVE appears in the CISA KEV catalog. CISA confirms active exploitation.
* **No:** CISA has not listed this CVE as actively exploited. The finding may still be Critical or have a public exploit.

### View and filter CISA KEV in STO <a href="#view-and-filter-cisa-kev-in-sto" id="view-and-filter-cisa-kev-in-sto"></a>

STO displays CISA KEV on the **Issues** page and the **Vulnerabilities** tab. You can inspect the signal on an individual issue or filter the full list.

1. Go to the [**Issues**](/security-testing-orchestration/use-sto/sto-security-issues/issues.md) page at the project level, or open the [**Vulnerabilities**](/security-testing-orchestration/use-sto/sto-security-issues/view-scan-results.md) tab for a pipeline execution.
2. Select an issue from the list and In the **Issue Details** side pane, locate the **CISA KEV** field. It shows **Yes** or **No**.

<figure><img src="/files/srmbxtfSFRBVSm63CzGA" alt=""><figcaption><p>Click to view full size image</p></figcaption></figure>

### How CISA KEV relates to other signals <a href="#how-cisa-kev-relates-to-other-signals" id="how-cisa-kev-relates-to-other-signals"></a>

Each prioritization signal measures a different aspect of risk. Use the list below to understand what each signal means and when to use it.

* [**CISA KEV**](#what-sto-shows)**:** Indicates whether CISA has confirmed active exploitation of this CVE and listed it in the KEV catalog.
* [**EPSS score**](/security-testing-orchestration/use-sto/risk-and-priortization/epss-score.md)**:** Estimates the statistical likelihood that this CVE will be exploited in the next 30 days.
* [**Reachability**](/security-testing-orchestration/use-sto/harness-security-scanners/sast.md#static-reachability)**:** Indicates whether the vulnerable code path is reachable in your application based on static analysis.
* [**Exploitability**](/security-testing-orchestration/use-sto/risk-and-priortization/epss-score.md) (scanner-specific): Indicates whether the scanner has found evidence of a known exploit or proof-of-concept for this CVE.
* [**Severity (CVSS)**](/security-testing-orchestration/new-to-sto/key-concepts/severities.md)**:** Rates the theoretical impact of the vulnerability if it is exploited, independent of whether exploitation has occurred.

### Enforce OPA policy <a href="#enforce-opa-policy" id="enforce-opa-policy"></a>

You can block pipelines when scan results include more CISA KEV issues than your team allows using an [OPA policy](/security-testing-orchestration/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#warn-or-block-vulnerabilities-based-on-cisa-kev-count). Go to **Account Settings**, select **Policies**, and search for the CISA KEV policy under **Security Tests** Entity.