KEV × STIG coverage checker
A live routing table: how many of CISA's known-exploited vulnerabilities touch the platforms we maintain DISA STIG baselines for — and how many do not. The gap is published, not hidden.
—KEV entries in catalog
—route to our maintained baselines
—touch no baseline we maintain
—STIG rules maintained across the set
loading…
Check a CVE
| CVE | Added | Product | Name | Routes to |
|---|---|---|---|---|
| loading… | ||||
Platform scoreboard
The stable, per-baseline read of this routing table lives in the coverage crosswalk.
loading…
Methodology and honest caveats
- Routed is not remediated. DISA manual STIGs harden configuration; they do not patch individual CVEs. A KEV entry routed to "Windows" means your Windows estate's hardening conversation belongs to a baseline we maintain — not that a specific rule neutralizes that CVE.
- The routing table is curated. KEV product/vendor text is matched against the platform families we maintain (Windows, macOS, RHEL 8/9, Ubuntu 20.04/22.04/24.04; the VMware estate: vSphere 6.5/6.7/7.0/8.0 — stated version routes that generation, unstated routes all four — plus vRealize, NSX, Horizon, Workspace ONE; Citrix Virtual Apps and Desktops; Microsoft Exchange + Outlook; Firefox; Proxmox baseline in build. NetScaler ADC/ShareFile/SD-WAN and other lookalike products stay uncovered on purpose). Versioned in the kevstig repo — corrections are welcome as pull requests.
- The gap is the artifact. The uncovered count (appliances, web apps, network gear, closed ecosystems) is published deliberately: it is the honest boundary of our maintained set and the workload plan behind our crosswalk work.
- Source: CISA Known Exploited Vulnerabilities catalog (JSON feed), refreshed daily by an automated job; baseline counts measured from the maintained checklists at generation time.