From Listing to Exploitation: Measuring KEV Entry Lag and Coverage Against Post-2024 Exploitation Evidence

Abstract

Background: CISA's Known Exploited Vulnerabilities (KEV) catalog is the most authoritative public statement that a vulnerability has been exploited — and, since 2024, the anchor of NIST's triage policy, with enriched analysis now promised for KEV entries within one business day of listing. Yet the catalog measures agency decisions , not exploitation itself, and the interval between the events that matter — CVE publication, KEV listing, and confirmed exploitation — has never been decomposed for the post-2024 period. Objective: This paper specifies a measurement framework for KEV entry lag and coverage, synthesizes the published record, and identifies the gaps that the 2026 enrichment policy leaves open. Methods: Documentary analysis of the KEV catalog's requirements and operations (2021–2026), the NVD prioritization policy of April 2026, and published exploitation-timing measurements; construction of a pipeline-lag decomposition and a gap-versus-mitigation matrix. Results: KEV listing is a lagged, decision-based signal: it requires an exploitation determination by CISA, not merely evidence, and its coverage is bounded by the catalog's statutory scope — non-federal, non-KEV high-risk vulnerabilities fall outside both the catalog and the new enrichment priority. We identify six residual gaps, of which the deepest is structural: the 2026 policy enriches the exploited minority within one business day while formally deprioritizing everything else, converting the enrichment gap into a permanent, policy-defined class. Conclusions: KEV-derived metrics should be reported as decision-lag measurements with explicit coverage bounds, complemented by predictive signals (EPSS) and community enrichment (ADP) — never as a complete map of exploitation.