All 16 CISA Exploited-Flaw Listings in October Carry a Three-Day Deadline, and 13 Add a Forensic-Triage Order

Every one of the 16 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalogue between October 1 and October 15 carries a three-day federal deadline, and 13 of them also carry a forensic-triage flag. That is the working form of Binding Operational Directive 26-04, issued June 10, and it changes what "patch it" means for an agency from a deadline into a 72-hour incident-response exercise.

The figures below come from CISA's own catalogue file, version 2026.10.15, which lists a date added, a due date and a forensicTriage field for each entry. The directive's own text is the second source.

What the catalogue shows

For entries added since BOD 26-04, the catalogue holds two windows, three days and fourteen days, and the shorter one is the norm.

1. July22 entries
2. August22 entries
3. September34 entries
4. October (to 15th)16 entries

Source: CISA Known Exploited Vulnerabilities catalogue, version 2026.10.15, accessed 2026-10-16 (October covers October 1 to 15)

Of 129 entries added from June 10 through October 15, 106 have a three-day window and 23 have a fourteen-day one. The last fourteen-day entry in the file is an Apple flaw, CVE-2026-86950, added September 29. Nothing added in October has one.

Added	CVE	Product	Due	Triage flag
October 15	CVE-2026-21589	Atlassian Data Center products	October 18	Yes
October 14	CVE-2026-0322	Palo Alto Networks PAN-OS	October 17	Yes
October 14	CVE-2026-76519	Cisco Secure Email Gateway	October 17	Yes
October 14	CVE-2026-105134	Ahsay AhsayCBS	October 17	Yes
October 14	CVE-2026-105133	Ahsay AhsayCBS	October 17	No
October 13	CVE-2026-104935	Ivanti Connect Secure	October 16	Yes
October 13	CVE-2026-96951	Microsoft Windows	October 16	Yes

Age does not buy a longer window. The five entries added on October 8 were a 2015 ISC BIND flaw (CVE-2015-5477), a 2016 Apache Struts flaw (CVE-2016-3081), a 2023 Strapi flaw, a 2021 ONLYOFFICE Docs flaw and a 2015 ProFTPD flaw (CVE-2015-3306). All five have three days, and four carry the triage flag.

What the directive asks of an agency

BOD 26-04 sets timelines by four variables: asset exposure, KEV status, exploit automation and technical impact. The clock starts at whichever comes first, CISA adding the CVE or the agency finding it on an asset. Days are calendar days, and the text says "the timelines for each asset are dynamic as facts change," so taking an asset off the internet moves its deadline back.

The directive's Table 1 holds the actual day counts, and the page presents it as an image, so the text does not state how a vulnerability lands in the three-day or fourteen-day row. That is a gap in what can be verified from the page, not a claim that the table is hidden.

Where Table 1 shows "& forensic triage," the agency "must complete remediation or mitigation action within the timeline (three days)" and also "carry out a forensic triage of the asset to assess whether the system is compromised."

The triage schedule fits inside the deadline only barely

CISA's implementation guidance gives a recommended sequence, and says the specific timeline "is not required." It runs, from the moment of the KEV addition:

1. Scoping, within 2 hours: confirm the CVE needs triage, activate the response team, set up an out-of-band channel.
2. Evidence collection, 2 to 24 hours: volatile data first, and no alteration of systems before collection.
3. Patching and stabilisation, 2 to 24 hours, only after evidence is collected.
4. Containment, 6 to 24 hours.
5. Triage analysis, 24 to 48 hours: unauthorised access, persistence, lateral movement, exfiltration.
6. Escalation decision and written report, 48 to 72 hours.

Read against a three-day due date, the order matters. Patching comes after evidence collection, so an agency that patches an Ivanti appliance on the morning of the due date, as an administrator would by habit, may have destroyed the memory evidence the guidance wants first. This is an inference from the guidance's ordering, not a statement CISA makes about any particular product.

For the PAN-OS and Cisco gateway flaws, which both give root, and the Ahsay flaws, a patch that did not stop exploitation, the ordering is where the argument for triage is strongest. Those two earlier stories said CISA's alert pages listed no federal due date. The catalogue file lists October 17 for all four entries, so the alert page was the less complete source.

The counter-case

The strongest objection is that the deadline binds agencies, not the thousands of private organisations running the same Atlassian or Ivanti software, and that those organisations get no triage schedule at all. That is accurate on the directive's text, which addresses agencies, though the catalogue is public and many private teams use it as their patch queue.

A second objection is volume. Sixteen entries in fifteen days, 13 with triage, is a load most agency teams would struggle to meet at the recommended pace. The catalogue does not report whether any agency met a given deadline, and this analysis cannot say whether they did.

What would change this reading

Two things would. If CISA publishes Table 1 in text, the rule for choosing three days over fourteen could be checked rather than inferred from the data. And if the October share of three-day entries falls back, the catalogue will show it: nothing in the file yet shows a fourteen-day entry after September 29.

The next dated item is Phase III of the directive, which requires agencies to remediate within Table 1's timelines 180 days after the June 10 issuance.