CISA's BOD 26-04 Deadlines: 120 of 152 KEV Entries Since June Carry a Three-Day Deadline

A CISA Known Exploited Vulnerabilities deadline no longer means 14 days by default. Of the 152 entries added since June 11, 2026, 120 carry a 3-day deadline and 97 of those also require forensic triage. That comes from our count of CISA's KEV catalog feed as released on November 6, 2026, which listed 1,769 entries in total.

The reason is Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," which CISA's directive page lists as issued June 10, 2026. It supersedes and revokes BOD 22-01 (November 3, 2021) and BOD 19-02 (April 29, 2019).

What the directive changes

BOD 26-04 applies to Federal Civilian Executive Branch agencies and ties the remediation timeline to four factors: asset exposure, KEV status, exploit automation and technical impact. Exposure means the asset is reachable by unauthenticated or untrusted entities over public networks such as the internet.

Timelines start when CISA adds the CVE to the KEV catalog or when the agency finds the vulnerability on an asset, whichever comes first. The directive says days are calendar days. Where its Table 1 includes "& forensic triage," the agency must fix or mitigate within three days and also assess whether the asset is already compromised. We could not read Table 1 itself, because the page publishes it as an image, so the exact mapping of factors to day counts is not reproduced here.

The directive applies to agency assets. It generally does not reach contractors unless a procurement contract directs it, and it excludes national security systems.

What the catalog shows

We computed the gap between dateAdded and dueDate for every entry added from June 11, 2026, the first date in the feed after the directive, and for the 31 entries added between May 1 and June 9.

Window	Entries	3-day deadline	14-day deadline
May 1 to June 9	31	12	18
June 11 to November 6	152	120	32

One earlier entry carried a 5-day deadline. After June 10 the feed holds only 3-day and 14-day windows. Within the 120 short-window entries, 97 are marked for forensic triage and 23 are not.

1. May 1 to June 9 (31 entries)39 %
2. June 11 to Nov. 6 (152 entries)79 %

Source: Terminal count of CISA KEV catalog feed released 2026-11-06, accessed 2026-11-07

The split is not uniform inside one vendor's flaws. For Ivanti Connect Secure, CVE-2026-111357 was added on October 30 with a 3-day deadline and a triage flag, while CVE-2026-118527, added the same day, got 14 days and no flag. The Plex2Shell chain behaves the same way: CVE-2026-96656 carries 3 days with triage, and CVE-2026-96652 carries 14.

Examples from the last week

The latest entries include the WordPress core flaw we covered, listed first below.

CVE	Product	Added	Window
CVE-2026-119977	WordPress core	November 3	3 days, triage
CVE-2024-27834	Apple WebKit	November 4	14 days
CVE-2026-19868	SonicWall SonicOS SSLVPN	November 6	14 days

CVE-2026-19868 lets a user with valid credentials for another authentication method bypass SAML controls, including SAML-enforced multi-factor authentication, per the catalog's description. Its deadline is November 20. The Apple entry covers a 2024 pointer-authentication bypass that Apple's Safari 17.5 advisory does not say was exploited; the catalog's presence is the only evidence of exploitation we found.

What a defender should take from it

Treat the three-day flag as an incident-response trigger and not only a patch deadline. The directive requires triage to the standard of CISA's Forensic Triage Guidance, citing NIST SP 800-61 Rev. 3 and SP 800-86 as examples. The same applies to entries such as the Brotli decoder flaw, which carried a November 10 deadline.

The directive also sets phase dates. Phase II, within 60 days of issuance, covered updating processes around the CVE database and KEV catalog. Phase III, within 180 days, requires remediation inside the Table 1 timelines and completed asset tagging. By our arithmetic from June 10, that is December 7, 2026.

CISA must reassess the timelines once per fiscal year, so the 79% share is a snapshot and not a rule.