CISA's Known Exploited Vulnerabilities catalog, read through an NHI lens

A TrustFix explainer on CISA's KEV catalog — the authoritative, public-domain list of vulnerabilities known to be exploited in the wild — and how exploitation so often pivots through non-human identities and the credentials they hold.

CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative, regularly updated list of vulnerabilities that are known to be exploited in the wild. It is the strongest single prioritization signal a defender has, and it is published as public-domain data — the cisagov/kev-data mirror is CC0, so it can be reproduced and built upon freely.

The NHI angle KEV doesn't draw for you. Exploitation rarely ends at the vulnerable service. Once an attacker gains a foothold, the next move is almost always about identity: harvesting a service-account token, abusing an over-privileged workload role, or pivoting through a long-lived static secret. A vulnerability in a public-facing app (MITRE ATT&CK T1190) becomes valuable precisely because of the non-human identities it can reach (T1078, Valid Accounts).

That is the synthesis a raw KEV entry doesn't include — and it is the value a security team actually needs: not just "this is exploited," but "here is which of your identities and tokens it would expose."

TrustFix analysis. We treat KEV as a prioritization input, then ask the question KEV leaves open: of the identities in your estate, which would an exploited entry let an attacker use, and is that access provably scoped? The honest republication rule applies — KEV and CVE Records are public-domain and shown in full with attribution; third-party reporting in this feed is link-only.