CISA KEV Catalog and AI-Discovered Vulnerabilities: When Glasswing CVEs Get Added

CISA launched the Known Exploited Vulnerabilities catalog in November 2021, simultaneously publishing Binding Operational Directive 22-01, which made KEV compliance mandatory for all federal civilian executive branch agencies. The catalog is publicly available and updated multiple times per week at cisa.gov, with a machine-readable JSON feed that can be integrated into vulnerability management platforms.

KEV matters for three reasons beyond regulatory compliance. First, it provides the highest-confidence exploitation signal available. CISA does not add CVEs to KEV based on theoretical severity or researcher publication; it requires evidence of confirmed active exploitation, sourced from threat intelligence, incident reports, and law enforcement partnerships. Second, it provides a forcing function for remediation programs that might otherwise deprioritize older CVEs. Many KEV entries are CVEs published years or even decades before their KEV addition, which exploitability was theoretical until threat actors developed reliable weaponization. Third, it is the primary input CISA recommends for risk-based patch prioritization, making KEV monitoring an expected component of mature vulnerability management programs across both public and private sectors.

CISA applies three criteria for KEV inclusion: the vulnerability must have an assigned CVE ID, there must be reliable evidence of active exploitation in the wild, and clear remediation guidance (typically a vendor patch or mitigation) must be available. CISA does not add vulnerabilities that are only theoretically exploitable or for which proof-of-concept code exists but no confirmed active exploitation has been observed.

The exploitation evidence that CISA accepts comes from multiple sources: CISA's own threat intelligence operations, FBI and IC community reporting, commercial threat intelligence providers, incident response firms reporting confirmed exploitation to CISA, and public reporting from security researchers. When multiple independent sources confirm active exploitation of a specific CVE, CISA moves quickly to add it to KEV.

Remediation guidance availability is a practical gate. CISA will not add a CVE to KEV before a patch or verified mitigation is available, because doing so would impose mandatory remediation timelines on federal agencies without providing a path to compliance. In practice, this means Glasswing CVEs that are in the CVD disclosure window (before public patch release) will not be added to KEV until the patch is publicly available, even if exploitation is already occurring.

Understanding the pipeline from AI discovery to KEV addition requires tracing the CVD lifecycle. Project Glasswing follows a coordinated disclosure process: Claude Mythos discovers a vulnerability, Anthropic notifies the affected vendor, the vendor develops a patch, and both Anthropic and the vendor coordinate disclosure with affected organizations before public publication. This process typically takes 60-90 days from initial discovery to public disclosure.

Once a Glasswing CVE is publicly disclosed with a CVE ID and patch available, threat actors begin reverse-engineering the patch to develop exploit code. For critical vulnerabilities, this weaponization timeline has compressed dramatically with AI: ExploitGym data shows that Claude Mythos generates 10.5 times more working exploits than Opus 4.6, and threat actors with access to similar AI capabilities can develop working exploits within hours to days of patch publication.

When exploitation of a Glasswing CVE is confirmed in the wild, the CVE enters the KEV pipeline. CISA's assessment of confirmed exploitation typically takes 24-72 hours once reliable evidence is submitted. The total timeline from public Glasswing CVE disclosure to KEV addition, for a vulnerability that is immediately weaponized, can be as short as one to two weeks. Organizations that wait for KEV addition to begin patching high-CVSS Glasswing CVEs are operating with a dangerously short remediation window.

Binding Operational Directive 22-01 requires all federal civilian executive branch agencies to remediate KEV entries by the due date specified by CISA in the catalog. CISA assigns remediation due dates based on the severity and exploitation context of each CVE: the standard window is 2-3 weeks, but CISA can assign shorter windows for critical infrastructure vulnerabilities or vulnerabilities actively used in ransomware campaigns.

For federal agencies, BOD 22-01 compliance is mandatory regardless of risk tolerance or resource constraints. Agencies that cannot remediate a KEV entry by the specified due date must report to CISA with an explanation and a remediation plan. Persistent non-compliance is escalated through CISA's FCEB vulnerability management program.

For federal contractors and cloud service providers operating under FedRAMP authorization, KEV compliance is embedded in their contractual and authorization obligations. FedRAMP-authorized services must remediate high and critical CVEs within 30 days; KEV addition effectively accelerates that timeline for in-scope CVEs. DoD contractors operating under CMMC Level 2 or Level 3 requirements face similar obligations through their contract requirements.

The practical implication for organizations that support federal agencies or operate under federal contracts is that KEV additions are not optional remediation signals. They are mandatory compliance triggers that require documented remediation or formal exception processes.

For private sector organizations, KEV is CISA's strongest recommendation for vulnerability prioritization, even without the legal mandate that applies to federal agencies. The logic is straightforward: if a vulnerability is in KEV, it is being actively exploited by real threat actors against real targets. Waiting to patch until it is convenient is no longer a defensible risk tolerance position.

Effective KEV integration in a private sector vulnerability management program means subscribing to the KEV JSON feed and triggering automated alerts whenever a CVE present in your environment is added to KEV. This requires knowing what software is deployed in your environment (software asset management and SBOM programs) and having a patching workflow that can be escalated to emergency timelines when a KEV addition affects in-scope systems.

For industries with specific regulatory frameworks, KEV should be mapped to compliance obligations. Healthcare organizations subject to HIPAA and HHS guidance should treat KEV additions affecting their environment as requiring immediate risk analysis under their HIPAA Security Rule program. Financial services firms should assess KEV entries under their existing vulnerability management frameworks, which in New York must satisfy 23 NYCRR 500 requirements for timely patching based on risk assessment.

Building a monitoring capability for Glasswing-attributed KEV entries requires combining two data streams. The first is the CISA KEV catalog, available via JSON feed and updated in near real-time. The second is the Glasswing CVE attribution list, which maps KEV entries to Glasswing disclosures and identifies the specific software components and versions affected.

Organizations can automate this monitoring using CISA's KEV JSON feed integrated with their vulnerability management platform (Tenable, Qualys, Rapid7, or similar). When a new CVE is added to KEV, the platform should automatically query the organization's asset inventory to identify affected systems and generate a prioritized remediation ticket.

For Glasswing CVEs specifically, the monitoring workflow should begin earlier than KEV addition. When a Glasswing CVD notification is received, the CVE should immediately enter the organization's tracking pipeline as a candidate for KEV addition, with remediation planning initiated in parallel with the KEV monitoring. This front-loads the assessment work so that when KEV addition occurs, remediation can begin immediately rather than triggering a new assessment cycle.

Two Glasswing CVEs illustrate the KEV pipeline dynamics in concrete terms. CVE-2026-4747 is a remote code execution vulnerability in FreeBSD's NFS implementation, discovered by Claude Mythos and disclosed through Project Glasswing's CVD process. FreeBSD is widely deployed in network infrastructure, storage appliances, and embedded systems. An NFS RCE vulnerability in FreeBSD creates a network-accessible code execution pathway that threat actors can exploit without authentication in default configurations.

CVE-2026-5194 is a certificate forgery vulnerability in wolfSSL, the embedded TLS library used in payment terminals, industrial controllers, medical devices, and networking equipment. With a CVSS score of 9.1, CVE-2026-5194 enables man-in-the-middle attacks against TLS-protected communications by forging certificates that wolfSSL will accept as valid. The breadth of wolfSSL deployment across critical infrastructure categories means CVE-2026-5194 has potential KEV impact across multiple CISA designated critical infrastructure sectors simultaneously.

For organizations that use FreeBSD-based network appliances or wolfSSL-integrated devices, both CVEs should have triggered immediate asset inventory queries when disclosed. The wolfSSL CVE in particular requires attention to embedded and OT systems where traditional patch management workflows may not reach, making compensating controls (network segmentation, enhanced monitoring for certificate anomalies) essential alongside patch planning.

Vulnerability management programs increasingly use three signals in combination for patch prioritization: CVSS (theoretical severity), EPSS (exploit probability), and KEV (confirmed exploitation). Understanding how these signals relate to each other and to Glasswing CVEs helps build a rational prioritization framework.

CVSS measures the inherent severity of a vulnerability based on its attack vector, complexity, authentication requirements, and impact on confidentiality, integrity, and availability. A CVSS 9.1 score (like CVE-2026-5194) indicates a highly severe vulnerability, but CVSS does not tell you whether the vulnerability is actually being exploited. Many CVSS 9+ vulnerabilities remain unexploited for years.

EPSS (Exploit Prediction Scoring System) uses machine learning to estimate the probability that a vulnerability will be exploited in the next 30 days, based on historical exploitation patterns and vulnerability characteristics. EPSS is useful for early-stage prioritization before exploitation is confirmed, but it is a probability estimate, not a confirmed fact.

KEV is the definitive signal: confirmed active exploitation, no statistical uncertainty. When a vulnerability is in KEV, all three of CVSS severity, EPSS probability, and confirmed exploitation are aligned. Glasswing CVEs that enter KEV should receive the highest remediation priority in any rational framework. For Glasswing CVEs not yet in KEV, CVSS plus EPSS scores provide the best pre-KEV prioritization signal.

The Mythos Brief provides the complete operational toolkit for integrating KEV monitoring into your vulnerability management program, with specific guidance for tracking Glasswing-attributed CVEs through the full pipeline from CVD notification to KEV addition.