CISA published Binding Operational Directive 26-04 on 10 June 2026. In its own words it supersedes and hereby revokes both BOD 19-02, from April 2019, and BOD 22-01, the November 2021 directive that created the Known Exploited Vulnerabilities catalogue and the deadlines attached to it.

The directive was reported at the time. What was not reported is what the catalogue has actually been doing, which is a question the catalogue answers itself. We downloaded the KEV JSON, 1,766 entries as released on 30 October, and did the arithmetic on every entry's date added against its due date.

Urgency is now four questions

The old model had one clock for everything in the catalogue. The new one asks four things about each flaw: is the asset publicly exposed, is the CVE in the KEV catalogue, can an adversary automate every step of exploitation, and does exploitation give partial or total control.

Four yes-or-no answers make 16 combinations, and the directive maps each one to a window. Clocks run in calendar days, not business days, and start at the KEV addition or the agency's own identification of the flaw, whichever comes first.

The scope is narrower than the headlines suggested. It binds FCEB agencies. National security systems, Department of War systems and Intelligence Community systems are excluded, and contractors are excluded unless their contract says otherwise.

The reading that explains the data

Of the 16 rows, 8 have the catalogue answer set to yes. Read down those eight and the windows are three days, three days, three days, fourteen, three, fourteen, fourteen, fourteen.

That is the whole range. Under this table, a vulnerability in the KEV catalogue can only ever draw three days or fourteen. There is no 21-day row. There is no 30-day row. The longer windows, 60 days and fix on the next system upgrade, are reachable only by flaws that are not in the catalogue at all.

The three-day rows carry one extra obligation. Where exploitation gives total control, the agency must also run forensic triage for compromise, following CISA's own triage guidance. The deadline is not only to patch. It is to check whether patching is already too late, which is a point worth holding on to for the next story on this page.

And the catalogue agrees

Here is the month-by-month count of which windows CISA actually used.

  • October 2025: 31 entries, every one of them 21 days.
  • January 2026: 17 entries, 15 at 21 days, 2 at three.
  • March 2026: 26 entries, 14 at fourteen days, 7 at 21, 5 at three.
  • April 2026: 31 entries, 23 at fourteen days, 8 at three.
  • June 2026: 23 entries, 17 at three days, 6 at fourteen.
  • September 2026: 43 entries, 34 at three days, 9 at fourteen.
  • October 2026: 36 entries, 29 at three days, 7 at fourteen.

April 2026 is the last month in which the 21-day window appears at all. June is the month three days became the majority, and June is the month the directive is dated.

So the tightening started before the paperwork. The 21-day clock was already dead two months before the directive that revoked the policy behind it, and every entry since has fallen into the two windows the table allows.

Across 2026 as a whole, 150 of 282 additions carry three days. Across the last 90 days, 81 of 106 are seven days or fewer.

Why the catalogue still looks lenient

Anyone reading the whole file gets a different impression, because history outweighs the present. The full catalogue holds 1,025 entries at 21 days, 284 at fourteen and 238 at 181. Those are old entries under an old policy, and they are not coming back.

One day, one vendor, two answers

The tiering is visible without any arithmetic at all if you look at 30 October, when two Ivanti Connect Secure flaws were added together.

CVE-2026-111357, missing authentication for a critical function, got three days. CVE-2026-118527, predictable identifiers, got fourteen. Same vendor, same product, same day, different technical impact, different clock.

The part that should not be true

Table 1 of the directive, which is where the tier-to-deadline mapping lives, is published only as an image. The deadlines in a binding federal directive are not in the text of the page that carries it.

Our cover is that image. It is readable, and it should not have taken a download to read it.

What to do

  • Stop quoting 21 days. If your internal standard still says three weeks, it is now looser than the federal baseline by a factor of seven on the worst flaws.
  • Separate total control from partial control in your own triage, because that single distinction is what moves a flaw between three days and fourteen.
  • Build the forensic check into the three-day path. The directive asks for triage, not just a patch, and triage takes longer to arrange than a reboot window.
  • Treat KEV addition as the start of the clock. Not your scanner's next run, not the vendor advisory date.
  • If you are a contractor to an FCEB agency, read your contract rather than the directive.

What is not established

  • Whether agencies are meeting these windows. The directive sets deadlines; the catalogue records them and nothing about compliance.
  • Why 21 days stopped being used in April. The pattern is in the data, the reason is not stated anywhere we could find.
  • How the four criteria are decided for a given CVE. CISA publishes the resulting date, not its answers to the four questions.
  • Whether the 60-day and fix-on-upgrade tiers are being used, since neither can appear in this catalogue by definition.
  • Whether any of this applies beyond FCEB. It does not bind anyone else, and the exclusions are explicit.