Question Vulnerabilities
What does the due date in the CISA KEV catalog mean?
It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.
What does the due date in the CISA KEV catalog mean? It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one. Source: https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/ (Cleartext, verified 2026-09-24)
Who the deadline binds #
BOD 22-01 requires US federal civilian executive branch agencies to remediate each KEV-listed vulnerability by the due date CISA sets for it.[1] In the current feed, 104 entries’ required-action text refers to BOD 26-04, Prioritizing Security Updates Based on Risk,[2] so read the entry’s own required action for the directive that applies.
How long the windows are #
Across the whole catalog, the median gap between the date an entry was added and its due date is 21 days. For entries added in the 365 days before the current release it is 14 days.[3]
| Window from date added to due date | All entries | Added in last 365 days |
|---|---|---|
| 7 days or less | 9% | 41% |
| 8 to 14 days | 16% | 25% |
| 15 to 21 days | 60% | 34% |
| 22 to 30 days | 0% | 0% |
| More than 30 days | 15% | 0% |
What to do with it #
Treat the due date as the outer limit, not the target: the entry is listed because attackers are already using it. A step-by-step process is in patch a KEV entry.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Adopting KEV due dates as internal service levels is an easy, defensible policy: they are set by a federal agency based on active exploitation.
Fintechs & payment firms
If a KEV deadline is shorter than your patch cycle, you need an emergency-change path. Most windows are measured in days or weeks, not quarters.
Developers & identity teams
The due date is in the feed as dueDate. Compute days remaining at ingestion and alert when an entry that matches your assets is inside it.
Follow-up questions #
- What happens if a private company misses a KEV due date?
- Nothing under the directive itself, which binds federal civilian agencies. Contracts, auditors or sector regulators may impose their own expectations.
People also ask #
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities (KEV) catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. Each entry gives a required action and a due date. US federal civilian agencies must act by that date; other organizations use the list to decide what to patch first. It holds 1,721 entries.
Full answerHow many vulnerabilities are in the CISA KEV catalog?
CISA’s Known Exploited Vulnerabilities catalog lists 1,721 vulnerabilities as of catalog version 2026.09.23, released September 23, 2026. 46 were added in the 30 days before that release, and 361 entries (21.0%) are flagged as known to be used in ransomware campaigns.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What does the due date in the CISA KEV catalog mean?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/
Markdown link
[What does the due date in the CISA KEV catalog mean?](https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. Numbers regenerate from the CISA feed on every build. |