# What does the due date in the CISA KEV catalog mean?

> **Short answer:** It is the date by which US federal civilian executive branch agencies must complete the entry’s required action, usually applying the vendor’s update or mitigation, or stop using the product. For entries added in the past year, the median window was 14 days. For everyone else it is a useful deadline, not a legal one.

- URL: https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)
- Data: computed from CISA KEV catalog 2026.09.23 at build time (2026-10-20)

## Who the deadline binds

BOD 22-01 requires US federal civilian executive branch agencies to remediate each KEV-listed vulnerability by the due date CISA sets for it.[^1] In the current feed, 104 entries’ required-action text refers to BOD 26-04, *Prioritizing Security Updates Based on Risk*,[^2] so read the entry’s own required action for the directive that applies.

## How long the windows are

Across the whole catalog, the median gap between the date an entry was added and its due date is 21 days. For entries added in the 365 days before the current release it is 14 days.[^3]

| Window from date added to due date | All entries | Added in last 365 days |
|---|---|---|
| 7 days or less | 9% | 41% |
| 8 to 14 days | 16% | 25% |
| 15 to 21 days | 60% | 34% |
| 22 to 30 days | 0% | 0% |
| More than 30 days | 15% | 0% |
Table: Share of KEV entries by remediation window, catalog 2026.09.23. Computed by Cleartext.

## What to do with it

Treat the due date as the outer limit, not the target: the entry is listed because attackers are already using it. A step-by-step process is in [patch a KEV entry](https://glide-cleartext.pages.dev/checklists/patch-a-kev-entry/).

## What this means for you

### Banks & credit unions

Adopting KEV due dates as internal service levels is an easy, defensible policy: they are set by a federal agency based on active exploitation.

### Fintechs & payment firms

If a KEV deadline is shorter than your patch cycle, you need an emergency-change path. Most windows are measured in days or weeks, not quarters.

### Developers & identity teams

The due date is in the feed as dueDate. Compute days remaining at ingestion and alert when an entry that matches your assets is inside it.

## Follow-up questions

**What happens if a private company misses a KEV due date?**

Nothing under the directive itself, which binds federal civilian agencies. Contracts, auditors or sector regulators may impose their own expectations.


## Sources

[^1]: BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. CISA, 2021-11-03. https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
[^2]: BOD 26-04: Prioritizing Security Updates Based on Risk. CISA. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
[^3]: Known Exploited Vulnerabilities catalog (JSON feed). CISA. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

## Related questions

- [What is the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/what-is-the-cisa-kev-catalog/)
- [How many vulnerabilities are in the CISA KEV catalog?](https://glide-cleartext.pages.dev/q/how-many-vulnerabilities-are-in-the-cisa-kev-catalog/)

## Cite

Cleartext. “What does the due date in the CISA KEV catalog mean?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-does-the-due-date-in-cisa-kev-mean/

## Changelog

- 2026-09-24: First published. Numbers regenerate from the CISA feed on every build.