In the CISA Known Exploited Vulnerabilities (KEV) catalog, version 2026.10.08, the due-date window changed a lot from year to year. Entries added in 2023, 2024 and 2025 mostly carry 21 days. Entries added in 2026 mostly carry 3 days (130 of 255). Additions per year range from 186 to 555, and the 2024 to 2026 additions are spread across 190 vendors.
- 3 daysMedian due-date window for entries added in 2026 (255 entries)Source: CISA KEV catalog, version 2026.10.08, downloaded 2026-10-09
- 21 daysMedian window for entries added in 2022 to 2025Source: CISA KEV catalog, version 2026.10.08, downloaded 2026-10-09
- 190Distinct vendors among entries added 2024 to 2026Source: CISA KEV catalog, version 2026.10.08, downloaded 2026-10-09
- 102Vendors with a single entry in 2024 to 2026Source: CISA KEV catalog, version 2026.10.08, downloaded 2026-10-09
Method: what did we count?
The catalog held 1,739 entries on the day we downloaded it, 2026-10-09. We grouped entries by the year in their “dateAdded” field. For each entry we subtracted “dateAdded” from “dueDate” to get a window in days. Then we counted how many entries share each window. For vendors we used the 686 entries added from 2024 to 2026 and counted entries per vendor name as the catalog gives it.
The year 2026 is partial. It runs only to 2026-10-08, the catalog release date. Read every 2026 figure as “so far”, not as a full year.
How many entries were added each year?
The yearly counts are 311 in 2021, 555 in 2022, 187 in 2023, 186 in 2024, 245 in 2025 and 255 in 2026 so far.The 2022 figure is the highest in the table. The data does not say why: the catalog only records what was added and when.
From 2023 to 2025 the count moves between 186 and 245. The 2026 count to early October is already above the full-year 2025 count. A partial year cannot be compared with full years for a trend, so we state the numbers and stop there. For the idea behind the catalog, see our glossary entry on known exploited vulnerabilities.
What due-date windows do KEV entries carry?
The window column is the “dueDate” field minus the “dateAdded” field. The reason for a given window is not in the catalog, so we do not explain it. The directive text says that agencies should remediate within 6 months for CVEs assigned before 2021 and within two weeks for others, and that these default timelines may be adjusted (BOD 22-01). We only report what the field contains.
- 2021181 days for 189 of 311 entries14 days for 111, 182 days for 11. Median 181.
- 202221 days for 403 of 555 entries14 days for 88, 181 days for 49, 184 days for 8, 31 days for 4, 4 days for 1. Median 21.
- 202321 days for 177 of 187 entries4 days for 7, one entry each at 7, 8 and 43 days. Median 21.
- 202421 days for 175 of 186 entries7 days for 7, 12 days for 2, one entry each at 2 and 8 days. Median 21.
- 202521 days for 226 of 245 entries7 days for 12, 1 day for 6, 2 days for 1. Median 21.
- 20263 days for 130 of 255 entries14 days for 78, 21 days for 44, 2 days for 2, 5 days for 1. Median 3.
Three patterns show in the counts. In 2021 the windows are long (181 days for 189 entries) or short (14 days for 111). In 2023, 2024 and 2025 one value, 21 days, covers the large majority of entries. In 2026 the largest group is 3 days, and 14 and 21 days both still appear. In 2026 the 21 day window covers 44 entries, against 226 in 2025.
Which vendors appear most often in recent additions?
Among the 686 entries added from 2024 to 2026, 190 distinct vendors appear. The five most frequent vendors account for 31.8 percent of those entries and the top ten for 43.7 percent. A further 102 vendors appear once. The table lists the ten most frequent. These are the vendors whose products are the subject of the CVEs, in count order. The list is not a ranking of quality or of how fast any vendor fixes things.
| Vendor named in the entry | Entries added 2024 to 2026 |
|---|---|
| Microsoft | 114 |
| Cisco | 32 |
| Apple | 25 |
| 24 | |
| Ivanti | 23 |
| Fortinet | 20 |
| Linux | 19 |
| Adobe | 17 |
| Citrix | 13 |
| Oracle | 13 |
Examples from vendors in that table with their own pages: Cisco IOS XE (CVE-2023-20198), Ivanti (CVE-2023-46805), Ivanti Connect Secure (CVE-2025-0282) and FortiOS (CVE-2024-21762).
A vendor with many products and a large install base can appear often for that reason alone. The catalog does not give us usage figures, so we cannot separate the two. Over all years, the catalog names 288 distinct vendors. For one case study of a Microsoft product see the SharePoint ToolShell incident, and for a Cisco one see the Cisco SD-WAN incident. How the entries split by product type is in our product type study.
Does a short window mean agencies patched faster?
No, not from this data. The “dueDate” field is a date set in the catalog for US federal civilian agencies. It does not show whether any agency met it, missed it or was exempt. It also does not say how long a fix took to build or to roll out. A shorter window tells us only that the catalog gave a shorter time.
For organizations outside the US federal government the field is not a requirement. How a team uses the list in its patch management and vulnerability management is outside what this data measures.
Limits: what can these figures not say?
- 2026 is a partial year, to 2026-10-08. Its counts and its window mix could change by December.
- The window is the “dueDate” field only. The reason for any change in windows is not in the catalog.
- The CISA page for BOD 22-01 is now marked as revoked and says it is superseded by BOD 26-04. We did not study that newer directive.
- Vendor names are as written in the catalog. We did not merge subsidiaries, so a company can be split across several names.
- Counting entries is not counting attacks. One entry is one CVE, and the catalog does not show how widely it was exploited.
What questions does this raise?
These are questions, not advice. If the window for new entries is now often 3 days, how long does your own process take from a catalog update to a decision? Which of the ten vendors in the table have products in your estate? Do you track entries that carry a short window separately from those that carry 21 days? How long a CVE waits before listing is covered in our note on days from publication to listing. For mapping what you run, see exposure management.
Five edge VPN and firewall entries that carry the ransomware flag are listed in Five edge VPN flaws CISA flags for ransomware use. A short window in practice: WatchGuard Firebox CVE-2025-14733 was added on 19 December 2025 with a due date of 26 December 2025.