CISA retired the three-week patch clock. The KEV data shows when
2026-11-03Security
BOD 26-04 revoked the policy behind the 21-day remediation window. The catalogue stopped using 21 days in April 2026, two months before the directive, and under the new table a KEV entry can only ever get three days or fourteen.