The Known Exploited Vulnerabilities catalogue is published as a JSON file. Every entry carries the date it was added and the date federal agencies must remediate it by. Subtract one from the other and you have the deadline CISA set, for every vulnerability it has ever listed.
We did that for all 1,769 entries in catalogue version 2026.11.06. The result is not what the catalogue's reputation suggests.
The whole catalogue
| Gap between added and due | Entries | Share |
|---|---|---|
| 21 days | 1,025 | 57.9% |
| 14 days | 286 | 16.2% |
| 181 days | 238 | 13.5% |
| 3 days | 151 | 8.5% |
| 7 days | 20 | 1.1% |
Twenty-one days is the norm and has been since the beginning. It is the deadline in Binding Operational Directive 22-01 for vulnerabilities disclosed from 2021 onward, and it covers nearly three fifths of everything in the file. The 181-day group is almost certainly the original backfill of older CVEs when the catalogue was created.
Now filter to this year
285 entries were added during 2026. Here is the same table for those:
| Gap | Entries added in 2026 | Share |
|---|---|---|
| 3 days | 151 | 53% |
| 14 days | 87 | 31% |
| 21 days | 44 | 15% |
Compare the two tables for a moment.
All 151 three-day deadlines in the entire catalogue were issued in 2026. Not most of them. All of them. The three-day deadline did not exist before this year, and it is now the majority of what CISA issues.
Meanwhile the twenty-one day deadline, which is 57.9 percent of the catalogue's history, is 15 percent of this year.
And in the last thirty days, across 30 entries: twenty at three days, ten at fourteen, and not a single one at twenty-one.
Something changed. As far as we can find, it was not announced.
The split looks arbitrary
If there were a rule, you would expect to see it. We cannot find one.
On 20 October, four Plex vulnerabilities were added on the same day. CVE-2026-96656 and CVE-2026-96654 got three days. CVE-2026-96655 and CVE-2026-96652 got fourteen. Same vendor, same product, same day, same catalogue release.
On 30 October, two Ivanti Connect Secure flaws were added together. One got three days, the other fourteen.
The obvious candidate explanation is ransomware association, because the catalogue carries a field for it. We checked. knownRansomwareCampaignUse reads Unknown for all six of those entries. Whatever is driving the split, it is not that field, and it is not visible in the file.
Why three days is a different kind of number
Twenty-one days is roughly a change window. Most organisations with a formal change process can get an emergency change approved, tested and deployed inside three weeks without breaking the process. Fourteen is tight. Three is not a deadline that an ordinary change process can meet.
Three days is shorter than a maintenance weekend. It is shorter than most emergency change approval chains in regulated environments. For a federal agency it is a directive and they will find a way, which is the point of a directive. But the catalogue's much larger audience is everyone else: the enormous number of private organisations that track KEV voluntarily because it is the best available signal of what is actually being exploited.
For that audience, a majority of entries now arrive with a deadline that is already impossible. What that produces is not faster patching. It is a queue in which most items are overdue on arrival, and a signal that stops carrying information because everything in it is red.
There is a version of this that is entirely defensible: exploitation now begins faster, sometimes within hours of disclosure, and a twenty-one day deadline is a fiction when the attack starts on day one. We wrote about the OpenSSH flaw being attacked within hours of its advisory. If that is the reasoning, it is good reasoning, and it would be worth saying out loud, because a deadline nobody explains is a deadline people learn to ignore.
What is not established
- Why the deadlines changed. We found no policy note and did not ask CISA.
- What distinguishes a three-day entry from a fourteen-day one. The catalogue does not say and the ransomware field does not explain it.
- Whether the text of BOD 22-01 has been amended, or whether these shorter deadlines are issued under some other authority.
- Whether federal compliance rates have moved since the change.
- Whether the 181-day group is the 2021 backfill. It is the obvious reading and we did not verify it.
- Everything here is one snapshot, version 2026.11.06. The file changes.
