CISA's three-day patch deadline did not exist before this year
2026-11-09Security
We counted the gap between the date added and the deadline for all 1,769 entries in the exploited vulnerabilities catalogue. Twenty-one days is the historic norm. Every three-day deadline ever issued was issued in 2026, and they are now the majority.