KEV Blocker Gate

Gate ID: kev-blocker

Blocks CVEs listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV entries represent vulnerabilities with confirmed active exploitation in the wild.

How It Works

For each CVE finding in the release candidate, checks KEV catalog membership
Blocks any CVE present in KEV, unless policy narrows the gate to reachable, severity-filtered, or past-due-only CVEs
Computes past-due status from PolicyGateContext.ReferenceTime, not from the host wall clock, so replayed evaluations keep the same verdict
Reports KEV due dates for remediation tracking

Configuration

{
  "Policy": {
    "Gates": {
      "KevBlocker": {
        "Enabled": true,
        "OnlyReachable": false,
        "MinimumSeverity": 7.0,
        "BlockPastDueOnly": false,
        "Environments": {
          "development": {
            "Enabled": false
          },
          "production": {
            "OnlyReachable": true,
            "BlockPastDueOnly": true
          }
        }
      }
    }
  }
}

Options

Option	Type	Default	Description
`Enabled`	bool	`true`	Whether the gate is active
`OnlyReachable`	bool	`false`	Only evaluate reachable CVEs
`MinimumSeverity`	double?	`null`	Minimum CVSS severity to block (`null` blocks all KEV CVEs)
`BlockPastDueOnly`	bool	`false`	Only block KEV CVEs whose due date is before `PolicyGateContext.ReferenceTime`
`Environments`	dict	`{}`	Per-environment overrides

KEV Catalog Context

The CISA KEV catalog contains:

CVEs with confirmed active exploitation
Required remediation due dates (typically 2-3 weeks from addition)
Affected vendor/product information

KEV inclusion indicates:

Real-world exploitation is occurring
Federal agencies must remediate by due date (BOD 22-01)
High priority for all organizations

Example Gate Results

Pass:

KEV blocker check passed. No KEV entries found in 15 CVE findings

Fail:

KEV entries found: CVE-2024-1234 (due: 2024-02-15, overdue), CVE-2024-5678 (due: 2024-02-28, 5 days remaining)

Warning:

KEV blocker check passed. Warnings: CVE-2024-9012 KEV due date approaching (7 days)

CLI Usage

# Evaluate KEV gate against image
stella policy evaluate --gate kev-blocker --image myapp:v1.2.3

# Check with no grace period
stella policy evaluate --gate kev-blocker --no-grace-period --image myapp:v1.2.3

Data Source

KEV data is fetched from CISA KEV Catalog via the configured IKevDataProvider. The catalog is refreshed daily with catalog update timestamps tracked for staleness detection.

Last updated: 2026-06-01.