CISA
US federal cyber lead; runs the KEV catalogue with mandatory federal patch deadlines.
On 29 July, CISA’s Known Exploited Vulnerabilities catalogue gave 34 of 39 new entries a patch Deadline of three days or less under its revised rules.
Last refreshed: 22 September 2026 · Appears in 1 active topic
How can CISA enforce its own KEV catalogue with 860 fewer staff?
Timeline for CISA
Added five advisory CVEs to KEV with three-day deadlines
Cybersecurity: Threats and Defences: Ten agencies name Beijing firm in hacksListed four Cisco flaws with three-day deadlines
Cybersecurity: Threats and Defences: Cisco reaches 100 entries on CISA's listGave 34 of 43 September KEV additions three-day deadlines
Cybersecurity: Threats and Defences: CISA set three-day deadlines on 34 flawsMentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesListed the first two flaws with a 30 September deadline
Cybersecurity: Threats and Defences: Citrix replaces its own NetScaler fixBackground
CISA is the United States federal agency responsible for helping protect civilian government networks and critical infrastructure from cyber threats. It sits within the Department of Homeland Security and runs the Known Exploited Vulnerabilities catalogue, which sets mandatory remediation deadlines for federal civilian agencies.
Created in 2018, the agency combines operational alerts, vulnerability direction and co-ordination with domestic and international partners. Its KEV catalogue translates evidence of active exploitation into deadlines, making it a practical bridge between threat reporting and federal action. CISA also issues joint advisories with other national agencies, including on Russian activity targeting Zimbra webmail in July 2026.
Its significance lies in setting the urgency signal for federal defenders while sharing guidance used beyond government. That role depends on identifying exploited flaws quickly enough for deadlines to alter real-world exposure. A proposed FY27 reduction of $707m and 860 posts, announced on 7 April, placed that capacity under scrutiny.
CISA shortens its patch deadlines
On 10 June, CISA replaced the fixed deadlines of Binding Operational Directive 22-01 with a risk-tiered system offering three-day, 14-day, 60-day or next-upgrade-cycle remediation windows. The change made its KEV catalogue a sharper federal compliance tool for flaws judged most dangerous.
Between 10 June and 29 July, CISA assigned three-day-or-shorter windows to 34 of 39 new KEV entries, compared with 12 of 31 in the preceding seven weeks. The median Deadline fell from 14 days to three, while the rate of catalogue additions remained near 0.78 a day.