KEV × STIG coverage crosswalk
The stable read of the routing table behind the live checker: which known-exploited vulnerabilities route to which maintained DISA STIG baseline, per-baseline coverage, and the gap ledger.
Built 2026-10-06 · CISA KEV catalog version 2026-10-04 · checker API generated 2026-10-06 17:55 UTC. The catalog drifts daily; the live per-entry routing always lives on the checker and its public API — this page restamps with each document revision.
What the crosswalk claims (and what it never will)
- Routed = a KEV entry's vendor/product text matches an ordered, curated family whose platform key matches a maintained baseline. Curation carries exclusion guards: lookalike products (Aria Operations for Networks, Horizon DaaS, IKE "key exchange" strings) stay honestly uncovered.
- Routed is not remediated. DISA manual STIGs harden configuration; the parsed STIG XMLs carry zero CVE references (verified). The claim is accountability, not patching.
- The gap is the artifact. The uncovered majority is published on purpose — it is the workload plan below.
Per-baseline coverage
Share of catalog = platform routings ÷ 1,734 catalog entries: what slice of the exploited-threat catalog lands on each maintained surface.
| Platform | Label | CKLs | Rules | KEV routed | Share of catalog | Newest routed KEV |
|---|---|---|---|---|---|---|
| windows | Microsoft Windows (all editions) | 4 | 1,084 | 178 | 10.3% | 2026-09-08 |
| macos | Apple macOS | 2 | 320 | 61 | 3.5% | 2026-08-18 |
| exchange | Microsoft Exchange | 7 | 432 | 18 | 1.0% | 2026-04-13 |
| vsphere67 | VMware vSphere 6.7 | 12 | 502 | 18 | 1.0% | 2026-08-18 |
| vsphere70 | VMware vSphere 7.0 | 12 | 491 | 18 | 1.0% | 2026-08-18 |
| vsphere80 | VMware vSphere 8.0 | 12 | 487 | 18 | 1.0% | 2026-08-18 |
| vsphere65 | VMware vSphere 6.5 | 3 | 180 | 18 | 1.0% | 2026-08-18 |
| firefox | Mozilla Firefox | 1 | 33 | 12 | 0.7% | 2024-10-15 |
| rhel8 | RHEL 8 | 1 | 371 | 3 | 0.2% | 2026-08-26 |
| rhel9 | RHEL 9 | 1 | 445 | 3 | 0.2% | 2026-08-26 |
| vrops6 | VMware vRealize Operations 6.x | 5 | 517 | 3 | 0.2% | 2026-03-03 |
| citrix | Citrix Virtual Apps and Desktops | 13 | 49 | 2 | 0.1% | 2021-11-03 |
| outlook | Microsoft Outlook | 2 | 146 | 2 | 0.1% | 2025-02-06 |
| workspace_one | VMware Workspace ONE UEM | 1 | 20 | 1 | 0.06% | 2026-03-09 |
| horizon | VMware Horizon 7.13 | 3 | 57 | 0 | 0 | — |
| nsx | VMware NSX | 13 | 131 | 0 | 0 | — |
| vra7 | VMware vRealize Automation 7.x | 8 | 611 | 0 | 0 | — |
| ubuntu24.04 | Ubuntu 24.04 LTS | 1 | 194 | 0 | 0 | — |
| ubuntu22.04 | Ubuntu 22.04 LTS | 1 | 188 | 0 | 0 | — |
| ubuntu20.04 | Ubuntu 20.04 LTS | 1 | 173 | 0 | 0 | — |
| proxmox | Proxmox VE (in build) | 0 | 0 | 0 | 0 | — |
Archived from this table 2026-10-06 (owner call): the RHEL 7 EOL row (1 CKL / 244 rules / 3 routings) — artifacts preserved under baselines/archive/rhel7 in the public baseline mirror; restorable per that archive's README. The vSphere generation rows plus 21 multi-platform entries explain why the 355 per-platform routings exceed the 298 unique routed entries.
Maintained but not KEV-routed (no routing family in the v1 table):
| Platform | Inventory | Rules |
|---|---|---|
| kubernetes | DISA Kubernetes STIG V2R6 CKL + scan/harden kit + kube-bench runner | 92 |
| docker | SRG-anchored host kit (controls + scan/harden) | n/a (kit, not a CKL) |
The gap ledger
Top uncovered vendor+product clusters (KEV entries) — the roadmap input:
| Vendor | Product cluster | Entries |
|---|---|---|
| Apple | Multiple Products | 54 |
| Chromium V8 | 41 | |
| Microsoft | Internet Explorer | 36 |
| Adobe | Flash Player | 33 |
| Linux | Kernel | 31 |
| Microsoft | Office | 29 |
| Microsoft | Win32k | 25 |
| Synacor | Zimbra Collaboration Suite | 16 |
| Adobe | ColdFusion | 16 |
| Adobe | Acrobat and Reader | 13 |
| Samsung | Mobile Devices | 13 |
| Oracle | WebLogic Server | 12 |
| Palo Alto Networks | PAN-OS | 12 |
| Microsoft | SharePoint | 10 |
| Qualcomm | Multiple Chipsets | 10 |
Top uncovered vendors: Microsoft 192, Adobe 82, Google 75, Apple 71, Cisco 68, Oracle 46, Apache 40, Ivanti 35, Fortinet 31, Linux 31.
Roadmap candidates (recurring KEV presence + enterprise install bases + hardening-guideline availability): Zimbra (16), Adobe ColdFusion (16), PAN-OS (12), WebLogic (12), SharePoint (10), and the Cisco IOS/IOS-XE surface (68 across the vendor, no baseline yet). Deliberately low-priority: Flash Player and Internet Explorer (dead products — coverage there buys nothing), generic vendor bundles and the Linux Kernel family (kernel exposure inside a maintained OS lands through that OS baseline's kernel rules).
The maintained set (resolved 2026-10-06)
The RHEL 7 EOL track was retired from the maintained set and the routing table on
the owner's call; its baseline artifacts are archived — not deleted — in
the baseline repo under baselines/archive/rhel7
(restore procedure in that archive's README). The maintained set is the 21 scoreboard
rows above plus the two maintained-but-unrouted rows; the routing table and the
checker API were rebuilt and redeployed the same day, gate-verified
(KEVSTIG-OK platforms=21 rules=6431 routed=298).