Why You Need a KEV-Driven Workflow Now
The Cybersecurity and Infrastructure Security Agency (CISA) recently added two Ivanti Connect Secure flaws to the Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation: CVE-2026-111357 and CVE-2026-118527. These vulnerabilities affect internet-facing remote access infrastructure, which is exactly where Binding Operational Directive (BOD) 26-04 directs your focus.
BOD 26-04, Prioritizing Security Updates Based on Risk, mandates Federal Civilian Executive Branch (FCEB) agencies to quickly remediate KEV-listed CVEs on publicly exposed assets that could be fully controlled if exploited. While this directive is mandatory for FCEB agencies, CISA encourages all organizations to adopt a similar approach. If you're a defense contractor, state agency, or StateRAMP-aligned provider, consider using BOD 26-04 as a template. The steps below will help you implement this approach effectively.
Preparing for Implementation
Before you begin, ensure you have:
- An authoritative asset inventory with internet-exposure details for each asset. This supports CM-8 (System Component Inventory) in NIST SP 800-53 Rev 5 and 3.4.1 in NIST SP 800-171.
- Vulnerability assessment tools that map findings to CVE IDs, such as Tenable, Qualys, or Rapid7, plus an external attack surface view from a perimeter scan.
- The KEV Catalog feed available in JSON and CSV on CISA's website.
- A ticketing system already used by your remediation team.
- Log retention on VPN gateways, authentication systems, and EDR to review activity before patching.
- A named decision owner with the authority to take a gateway offline if needed.
Step-by-Step Implementation
Step 1: Automate KEV Feed Ingestion
Schedule a daily job to pull the KEV catalog:
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
-o kev.json
jq -r '.vulnerabilities[] | [.cveID, .vendorProject, .product, .dateAdded, .dueDate] | @csv' kev.json > kev.csv
Compare each day's file with the previous one to highlight new additions. Use a KEV tag in your scanner platform if available.
Step 2: Match KEV Entries to Your Inventory
Match CVE IDs from scanner output to your inventory, confirming product and version details manually for appliances like Ivanti Connect Secure, which may be missed by scans.
Step 3: Apply BOD 26-04 Priority Test
For each KEV match, determine:
- Is the asset publicly exposed?
- Does exploitation grant total control?
If both are true, prioritize the finding. For exposed Connect Secure gateways, both Ivanti CVEs should be top priority. Document any deferrals with a rationale, creating a Risk Response record for audit purposes.
Step 4: Define Remediation Clocks
Set remediation timelines in policy:
| Tier | Criteria | Clock |
|---|---|---|
| 1 | KEV, exposed, total control | Shortest SLA; emergency change |
| 2 | KEV, internal or limited impact | Standard expedited SLA |
| 3 | Non-KEV | Normal patch cycle |
Align Tier 1 timing with incident-reporting requirements, especially under DFARS 252.204-7012.
Step 5: Conduct a Pre-Patch Compromise Check
Before patching, check for signs of compromise:
- Review logs for unexpected admin sessions, new accounts, or configuration changes.
- Use the vendor's integrity checker if available.
- Preserve evidence and escalate if compromise is detected.
Step 6: Patch and Verify
Apply the vendor fix through your emergency change process. Record pre- and post-patch versions. If the vendor advises credential or certificate rotation, include it in the same change.
Validation: Ensuring Effectiveness
- Rescan the asset to confirm the CVE is resolved.
- Reconcile the feed to ensure all KEV CVEs are addressed.
- Test the pipeline with a historical KEV entry to verify your process.
- Check the evidence trail for Tier 1 items, mapping to RA-5, SI-2, and relevant NIST SP 800-171 controls.
Ongoing Maintenance
- Daily: Review KEV diffs and new Tier 1 matches.
- Weekly: Report open KEV items by age.
- Quarterly: Audit for unmanaged exposed assets.
- Annually: Review tier definitions and SLAs.
Contribute to the Catalog
If you discover exploitation of an unlisted vulnerability, submit it to CISA through the KEV Nomination Form. Provide a CVE ID, evidence of exploitation, and mitigation guidance. Coordinate with legal and contracting officers if necessary.
Implementing a KEV-driven workflow turns each new KEV entry into a routine task rather than a crisis.
