When CISA added a Linux kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October, the due date in the feed was 31 October. Three days. The same day’s VMware ESX entry, CVE-2026-41709, got 14. That gap is not noise. It is the visible output of a directive issued in June, applied through the KEV feed, and it changes what “patch it” means for anyone who watches the KEV feed, federal or not.
What the directive did
CISA’s Binding Operational Directive 26-04, dated 10 June 2026, revokes BOD 19-02 and BOD 22-01 and replaces both with one risk-based model. According to the directive, remediation urgency depends on four variables: whether the asset is publicly exposed, whether the CVE is in the KEV catalog, whether an adversary can automate every step of exploitation, and whether exploitation gives partial or total control.
The directive says this approach “focuses patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally,” and it gives its own reason for urgency: attackers’ use of AI “may further narrow the time defenders have to react between patch release and possible exploitation.” Table 1 sets the timelines, and it is informed by CISA’s SSVC decision model. The table is a 16-row image. In our reading of it, “3 days & forensic triage” applies to three rows: publicly exposed, in the KEV, automatable and total control (row 1); publicly exposed, in the KEV, not automatable, total control (row 3); and, notably, not publicly exposed but otherwise the same as row 1 (row 9). A KEV entry with partial control on an exposed, automatable asset gets 3 days without triage (row 2). A publicly exposed, automatable, total-control vulnerability that is not in the KEV also gets 3 days (row 5). The remaining KEV rows are 14 days, and low-risk items can wait for the next system upgrade.
The phasing is in the directive text. Policies update immediately, processes within 60 days (by our calculation, around 9 August) and the Table 1 deadlines within 180 days (around 7 December). So the three-day deadlines do not formally bind agencies until December, yet CISA is already applying them in the KEV feed. The directive covers federal civilian agencies and, unless a contract says otherwise, not their contractors.
What the feed shows
We pulled the KEV JSON feed released 28 October 2026 at 19:00 UTC and compared due dates against dates added. This is our own tabulation of one feed snapshot, not a CISA statistic.
- Of 145 entries added from 10 June to 28 October, 116 (80%) have a three-day due date and 29 have 14 days.
- 94 entries carry a
forensicTriagevalue of “Yes”. All of them have a three-day deadline. 22 more three-day entries do not. - Of 133 entries added from 1 January to 9 June, 31 had a three-day due date; 55 had 14 days and 44 had 21 days.
- Within the three-day group, Cisco and Microsoft lead with 9 entries each, followed by Linux (6) and Fortinet and Citrix (5 each).
The trend did not start on 10 June: by our tabulation 2 of 17 entries added in January had three-day deadlines, against 5 of 10 added from 1 to 9 June. But the step up afterwards is large, and the forensicTriage field is “No” on every earlier entry, with the first “Yes” dated 25 June. We did not check each CVE’s SSVC values against its due date. The VMware entry is the contrast case: 14 days and no triage flag.
Why triage is the real change
The new part is not the three-day clock. It is that the directive pairs the deadline with a compromise assessment. CISA’s implementation guidance lays out a sequence with targets measured in hours: early steps within 2 to 24 hours of the KEV addition, and an escalation decision within 48 to 72 hours. If the triage finds confirmed compromise, the agency reports to CISA and pivots to incident response.
The logic is simple. A KEV entry means exploitation has already been observed. For an exposed asset, waiting three days to fix it implies the system may have been hit before the fix. Patching removes the door. It does not tell you who already walked through it.
In our assessment, this moves the unit of work from “apply update” to “apply update and prove the host is clean”, which is a staffing and tooling question, not only a change-management one. Teams that can patch in three days but cannot pull logs and run indicator hunts in the same window will meet the letter of the deadline and miss its point.
What it means beyond federal agencies
Private organisations are not bound by BOD 26-04, though CISA’s 28 October alert “encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.” Three things follow, in our view.
First, the KEV feed has become a de facto urgency signal. When four in five new entries say three days, a board asking “are we exposed to anything on the KEV list?” is asking a time-boxed question, whatever your legal status.
Second, exposure tagging is the dependency. The directive requires agencies to tag assets with environment, exposure and asset type. Where an agency has not supplied exposure data, the guidance says CISA makes a best-effort call: public if the asset has a routable IP address, public if its asset type is network, public for KEV CVEs in generally public-facing software, otherwise internal. That fallback applies to agencies. Our inference is that any organisation without a reliable internet-facing inventory will struggle to know which row of the table it is in.
Third, network and edge vendors appear repeatedly in the three-day group alongside Microsoft: Cisco, Fortinet, Citrix, SonicWall and Check Point all have multiple entries. Raw counts at an 80% base rate say little about over-representation, so this is our assessment rather than a data finding: operators of firewalls, VPN gateways and similar devices should rehearse triage for those categories first.
What to do now
- Build the exposure list. Tag internet-reachable assets and keep it current weekly, in line with the seven-day reporting and discovery cadence in the directive and the guidance.
- Write the triage runbook before the next KEV addition: which logs to pull, which indicators to check, who decides on escalation, and how to document it.
- Track mean time from KEV addition to “patched and triaged”, not just to patched.
- Treat the 14-day class as real work, not backlog. Those entries are still known-exploited.
The directive’s own framing is that defenders should spend effort where risk is highest. The feed suggests CISA now treats most newly listed exploited vulnerabilities as top priority, with a response that assumes the attacker may have arrived first.
Limitations: the feed analysis covers one snapshot (released 2026-10-28T19:00Z). Our reading of Table 1 comes from the published image and is single-source. We have not verified how each due date was assigned. Statements about what organisations “should” do are our assessment.