Detect and prioritize CISA Known Exploited Vulnerabilities in the cloud with Wiz

For each CVE, the Wiz Research team maintains data from multiple threat intelligence sources and our own independent research. Now that we’ve added support for the new CISA KEV catalog, learn how you can use it in your cloud environment.

Wiz supports the newCISA Known Exploited Vulnerabilities (KEV) Catalogas a source of exploit intelligence to vulnerability findings, on top of other sources. The new CISA binding directive helps enterprises to reduce cyber incidents by prioritizing the mitigation of vulnerabilities known to be actively exploited in order to improve the vulnerability management process. Vulnerabilities listed in the KEV catalog are less than 1% of the vulnerability findings in the cloud. Combined with the unique capabilities offered by Wiz to discover the toxic combinations that represent a real threat in your cloud environment, you can now better prioritize and focus on the risks that matter the most.

CISA, the Cybersecurity & Infrastructure Security Agency, released abinding operational directiveto reduce the significant risk of known exploited vulnerabilities. In recognition that vulnerabilities that have been previously exploited are a frequent vector for malicious cyber actors, CISA prioritizes these vulnerabilities as the biggest threats that must be aggressively remediated. Since November 2021, CISA has managed a catalog of known exploited vulnerabilities that carry significant risk, along with remediation requirements. Federal agencies are compelled to patch these vulnerabilities within the timeframe defined by CISA.

Currently, there are more than 352 vulnerabilities in thecatalog, covering vulnerabilities in operating systems (e.g. Windows, Linux), proprietary applications (e.g. SolarWinds products, Zoho ManageEngine ServiceDesk), and open source projects (e.g. Apache HTTP Server, Log4j).

Thelatest vulnerability, a Microsoft Win32k privilege escalation vulnerability (CVE-2022-21882), was added on February 4th, 2022 and required remediation action within 14 days. Even though the CISA directive is binding for US federal agencies specifically, it is quickly becoming a best security practice for public and private sectors as well.

Wiz utilizesagentless scanningto build an inventory of your cloud infrastructure — across workloads, accounts, and environments. It delivers unified coverage across clouds and compute architectures from virtual machines and containers to serverless functions.

For each CVE, the Wiz Research team maintains data from multiple threat intelligence sources and our own independent research. Now that we’ve added support for the new CISA KEV catalog, here’s how you can use it in your cloud environment:

Review the dedicated dashboard– You can immediately assess the vulnerability posture across your organization by logging into the newCISA Known Exploited Vulnerability Catalog CVEsdashboard, which lists all the resources in your cloud environment that are currently vulnerable to one or more vulnerabilities in the catalog.

Use the dedicated search– You can query and locate all the VMs, containers, and serverless functions in your cloud environment that are vulnerable to a specific CVE in the catalog with a simple query shortcut.

Vulnerability management teams nowadays face hundreds or even thousands of vulnerabilities. It’s quite challenging to try to remediate each one of them. So the question becomes, which ones should be prioritized?

Wiz scans the entire stack to identify the toxic combinations that represent real risk to your environment. Using the Wiz contextual security graph, you can prioritize patching by focusing on these toxic combinations and finding the resources that pose the highest risk in your cloud environment. For example:

Exposed resources— A vulnerable VM with access to the Internet poses a greater risk since it can be more easily exploited by malicious actors.

High privileged resources— A vulnerable VM that can assume an admin IAM role or contains an API key with admin privileges is at much higher risk to gain control of your environment.

Leveraging the contextual understanding of your cloud environment provided by Wiz with the CISA KEV catalog input allows you to better prioritize and mitigate the critical risks in your environment, by locating your vulnerable assets that pose the highest risk. The example below shows a Wiz Security Graph view of a VM vulnerable to one or more vulnerabilities in the KEV Catalog, that also has access to the internet and private keys with highly privileged permissions. With such a combination of risk factors, this VM would represent a high priority asset to remediate.

The CISA KEV catalog is a valuable initiative that helps enterprises with theirvulnerability managementby which which vulnerabilities are known to be exploited. With theagentlesspatch management capabilities provided by Wiz and KEV insights combined, enterprises can identify and prioritize high impact vulnerabilities across their cloud environment tosignificantly improve their security posture.

Learn how to achieve compliance security at scale with Wiz and RegScale, supporting a variety of compliance framework controls.

In this post, we discuss five security limitations of endpoint security agents and also explain how adding agentless solutions can improve your cloud environment security.

As more organizations move to the cloud, so do attackers. What can you do to better protect your cloud environment in 2022? Wiz Research has compiled the most pressing cloud security threats and how you can protect against them.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings