--- title: "Exploited flaws now get 3 days, not 21: CISA rewrote the patch clock" summary: "CISA's catalogue of exploited flaws counted by deadline, 1 January to 6 July 2026 against 2025, and the 10 June directive that ended the 21-day clock." url: https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3 format: Analysis desk: "Security operations" published: 2026-07-07 facts_checked: 2026-07-07 author: TechBag (The TechBag Journal) tags: ["CISA KEV","BOD 26-04","BOD 22-01","patch management","vulnerability management","Verizon DBIR","CERT-In","RBI","SEBI CSCRF"] cover: https://www.thetechbag.com/blog/covers/cisa-exploited-flaw-deadline-21-days-to-3.png --- # Exploited flaws now get 3 days, not 21: CISA rewrote the patch clock *CISA's catalogue of exploited flaws counted by deadline, 1 January to 6 July 2026 against 2025, and the 10 June directive that ended the 21-day clock.* Analysis · Security operations · By TechBag · Published 2026-07-07 · Facts checked 2026-07-07 · Canonical: https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3 The short version - The 21-day patch deadline is over. On 10 June CISA revoked the directive behind it and replaced it with four questions; an exploited flaw on an internet-facing system that can be attacked automatically, or that hands over total control, now gets 3 days, and no exploited flaw gets more than 14.[1] - The catalogue moved first. In the first half of 2025 no entry in CISA’s exploited-vulnerability list had a deadline of 3 days or less; between 1 January and 6 July 2026, 46 of 147 did, and in June 17 of 23 did.[4] - India’s regulators still mostly say “timely”; SEBI’s 7 days for a High patch binds only market infrastructure and its larger regulated firms.[10][11] Our view: a board should set 3 days for an exploited flaw on anything reachable from the internet and 7 days for one inside the network, and ask each month how many are late. For four years the number to copy was 21. CISA’s catalogue of Known Exploited Vulnerabilities (KEV) gave almost every entry three weeks, US federal agencies had to meet it, and outside government it became a ready-made answer to the question of how long is too long for a flaw that attackers are already using. That number has now gone, and the replacement is not one number but a short decision table. The question for anyone who owns a patch policy, or signs off on one, is what to write down instead. ## Four questions replaced one number Binding Operational Directive 26-04, issued on 10 June, “supersedes and hereby revokes” BOD 22-01, the 2021 directive that created the KEV catalogue, and BOD 19-02, which gave agencies 15 days for critical flaws on internet-facing systems.[1][5] The deadline now depends on four answers: is the asset publicly exposed; is the flaw in the KEV; can an adversary automate every step of the exploit; and does it give partial or total control. CISA publishes the last three for every CVE through its Vulnrichment programme; the agency answers the first.[1] Where control is total and the asset is exposed, the 3 days come with a “forensic triage”: patching is not enough, the agency must also check whether the system was already compromised. Flaws outside the KEV get 3, 14 or 60 days, or wait for the next scheduled upgrade. The clock starts when CISA lists the flaw or when the agency first detects it on an asset, whichever is earlier, and taking a system off the internet is itself a valid move that lengthens its deadline.[1] **Figure: Half the cases for an exploited flaw now carry a 3-day deadline; none carries more than 14** *Remediation deadline in calendar days for a flaw in CISA's KEV catalogue, by exposure, automation and impact, under BOD 26-04 of 10 June 2026* Exposed, automatable, total control 3 days Exposed, automatable, partial control 3 days Exposed, not automatable, total control 3 days Exposed, not automatable, partial control 14 days Internal, automatable, total control 3 days Internal, automatable, partial control 14 days Internal, not automatable, total control 14 days Internal, not automatable, partial control 14 days | | Value (days) | | --- | --- | | Exposed, automatable, total control | 3 | | Exposed, automatable, partial control | 3 | | Exposed, not automatable, total control | 3 | | Exposed, not automatable, partial control | 14 | | Internal, automatable, total control | 3 | | Internal, automatable, partial control | 14 | | Internal, not automatable, total control | 14 | | Internal, not automatable, partial control | 14 | Source: CISA, BOD 26-04, Appendix A, Table 1 (rows 1 to 4 and 9 to 12) · as of 10 June 2026 · 'Exposed' means reachable by unauthenticated or untrusted parties over public networks; 3-day cases with total control also require forensic triage CISA gives its reason in the directive’s background, and it is about speed rather than volume. > “Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation.”CISA, BOD 26-04, 10 June 2026 Agencies must meet Table 1 within 180 days of issuance, which is 7 December.[1] The catalogue does not wait: CISA’s implementation guidance says the due date printed on each KEV entry is now calculated from the same table, assuming exposure where CISA has evidence of it. “If CISA determines that the vulnerability is present in a publicly exposed asset, the technical impact is total, and that it is automatable by an adversary, the KEV’s due date will reflect a 3-day patching deadline.”[2] ## The catalogue already shows it: 21 days, then 14, then 3 We counted every KEV entry by the gap between the date CISA added it and the due date it set. Through 2023, 2024 and 2025 the median was 21 days in each year. In 2026 the pattern broke twice. The last 21-day entry was added on 5 March and the first 14-day entry on 9 March; from then until early June, 14 days was the default, with 3 days for the worst cases. From June, 3 days became the norm.[4] 3 days Median deadline for the 23 KEV entries CISA added in June 2026 Every month of 2025 had a median of 21 days. Since 10 June, 13 of 14 new entries were due in 3 days. [4] **Figure: In six months the 21-day deadline went from nearly every entry to none** *Share of KEV entries by days allowed to fix, January to June 2025 combined, then each month of 2026* Jan–Jun 2025 98% Jan 2026 88% Feb 2026 21% 79% Mar 2026 19% 54% 27% Apr 2026 26% 74% May 2026 33% 67% Jun 2026 74% 26% | | 3 days or less | 4 to 14 days | 21 days | | --- | --- | --- | --- | | Jan–Jun 2025 | 0 | 3 | 129 | | Jan 2026 | 2 | 0 | 15 | | Feb 2026 | 6 | 0 | 22 | | Mar 2026 | 5 | 14 | 7 | | Apr 2026 | 8 | 23 | 0 | | May 2026 | 7 | 14 | 0 | | Jun 2026 | 17 | 6 | 0 | Source: TechBag count of CISA's KEV catalogue (dateAdded and dueDate per entry) · as of 6 July 2026 · entries per row: 132 (Jan to Jun 2025); 17, 28, 26, 31, 21 and 23 (Jan to Jun 2026) TechBag countTechBag count: how we measured the clock For each of the 1,631 KEV entries added on or before 6 July 2026 we subtracted `dateAdded` from `dueDate`. From 1 January to 6 July 2026 CISA added 147 entries, against 135 in the same days of 2025; 46 had 3 days or less, against none. The median was 14 days, against 21.[4] What drew 3 days after 10 June is mostly software that commonly faces the internet: Ivanti Sentry, Oracle PeopleSoft, a LiteSpeed cPanel plugin, a Joomla editor extension, Splunk Enterprise, a Lantronix device server, three flaws in Ubiquiti’s UniFi OS, PTC Windchill, Cisco Unified Communications Manager, SimpleHelp remote support and, on 1 July, Microsoft SharePoint Server. Three of the 14 carry CISA’s “known ransomware use” flag. The one exception, a Cisco Catalyst SD-WAN Manager path-traversal flaw, got 14 days.[4] ## Short clocks were the exception for a year before they became the rule Three-day deadlines are not new; what is new is that they are ordinary. BOD 22-01’s own text set a default of two weeks for recent CVEs, adjustable “in the case of grave risk”.[3] CISA nonetheless gave almost everything 21 days, and used short windows as an emergency brake: one day for Citrix NetScaler in July 2025, for three SharePoint flaws the same month and for Cisco’s ASA firewalls in September; two days for Cisco SD-WAN on 25 February 2026, the day it issued Emergency Directive 26-03.[4][6] Across all of 2025, 7 of 245 entries had 3 days or less.[4] **Figure: The emergency brake of 2025 became the default setting by June 2026** *Selected KEV deadlines and CISA directives, July 2025 to the BOD 26-04 compliance date* | Date | Event | Detail | | --- | --- | --- | | 10 Jul 2025 | Citrix NetScaler: 1 day | the first 1-day deadline of 2025 | | 25 Sept 2025 | Cisco ASA: 1 day | two firewall flaws | | 27 Jan 2026 | Fortinet: 3 days | the first 3-day deadline of 2026 | | 25 Feb 2026 | Cisco SD-WAN: 2 days | with Emergency Directive 26-03 | | 9 Mar 2026 | 14 days becomes the default | the last 21-day entry was added on 5 March | | 10 Jun 2026 | BOD 26-04 issued | BOD 22-01 and BOD 19-02 revoked | | 1 Jul 2026 | SharePoint: 3 days | flagged for known ransomware use | | 7 Dec 2026 | Table 1 binds agencies | Phase III, 180 days after issuance | Source: CISA KEV catalogue (TechBag count); CISA ED 26-03 V1; CISA BOD 26-04 · as of 6 July 2026 · 7 December 2026 is computed as 180 days after 10 June, the directive's Phase III deadline The March step to 14 days is the two-week default BOD 22-01 had always written down; June’s step to 3 is BOD 26-04. A team that tracks only the directives would have missed the first change by three months. ## The old clock was already too slow, and most organisations missed it anyway CISA’s case for a short clock was in its 2021 directive. Of the exploited CVEs it had studied, “42% are being used on day 0 of disclosure; 50% within 2 days; and 75% within 28 days.”[3] A 21-day deadline therefore arrived after most of the exploitation it was meant to prevent. And the deadline was not being met. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the way in for 31% of breaches, overtaking stolen credentials, at 13%, as the most common way in.[7] As summarised by Help Net Security, only 26% of critical KEV flaws were fully remediated during 2025, down from 38% a year earlier, and the median time to full remediation rose to 43 days.[8] **Figure: Half of exploited flaws are attacked within two days; only a quarter of critical KEV flaws were fully fixed in 2025** *Per 100: exploited CVEs used within 2 days of disclosure (CISA, 2021); critical KEV flaws fully remediated in 2024 and 2025 (Verizon DBIR 2026)* 50% Exploited CVEs used within 2 days of disclosure 42% on day 0 38% Critical KEV flaws fully remediated during 2024 26% Critical KEV flaws fully remediated during 2025 Source: CISA, BOD 22-01 FAQ (2021); Verizon DBIR 2026 as reported by Help Net Security (25 May 2026) · as of 25 May 2026 · different populations: CISA's share is of exploited CVEs; Verizon's is of critical KEV flaws in its dataset Our view Our view: BOD 26-04 does not ask federal agencies to work faster on everything. It asks them to work much faster on a small set and allows 60 days, or the next upgrade, for flaws nobody is exploiting. That is the trade a stretched team needs. The hard part is the input, not the deadline: without knowing which assets face the internet, nobody can tell a 3-day flaw from a 14-day one. ## What a board should write down The directive binds US civilian agencies, not companies; it does not even reach federal contractors unless their contracts say so.[1] But it is now the most detailed public benchmark for a patch deadline that we know of, and it sits a long way from what most internal policies say and from what most organisations achieve. **Figure: The new benchmark is 3 days; the measured median is 43** *Days allowed or taken to fix, by rule or measure, as published to June 2026* CISA KEV, exposed and automatable or total control 3 days SEBI CSCRF, High patch (MIIs, Qualified REs) 7 days CISA KEV, every other case 14 days CISA BOD 19-02, critical and internet-facing (revoked) 15 days CISA KEV practice, 2022 to March 2026 21 days Median time to full remediation (DBIR 2026) 43 days | | Value (days) | | --- | --- | | CISA KEV, exposed and automatable or total control | 3 | | SEBI CSCRF, High patch (MIIs, Qualified REs) | 7 | | CISA KEV, every other case | 14 | | CISA BOD 19-02, critical and internet-facing (revoked) | 15 | | CISA KEV practice, 2022 to March 2026 | 21 | | Median time to full remediation (DBIR 2026) | 43 | Source: CISA BOD 26-04, BOD 19-02, KEV catalogue; SEBI CSCRF (20 Aug 2024); Verizon DBIR 2026 via Help Net Security · as of 6 July 2026 · the DBIR figure is a measured median time to full remediation; every other bar is a deadline **Exploited and reachable from the internet: 3 days.** Patch, or take the system off the internet until you can, then check whether it was already compromised. The forensic step matters because a flaw is often used before it is listed.[3] **Exploited, inside the network: 7 days.** Tighter than CISA’s 14, and the same as the strictest Indian rule we found (see below). **Not known to be exploited: 14 days for critical flaws on exposed systems, 60 days or the next upgrade for the rest.** “Known to be exploited” means the KEV catalogue or the vendor’s own advisory, whichever says so first. **Exceptions in writing.** A system that cannot meet its clock gets a named owner, a compensating control and an end date, and the board sees the count of overdue exploited flaws every month. The policy also needs one prerequisite, which BOD 26-04 makes a requirement for agencies: an inventory that tags every asset as exposed or internal.[1] Our view The case against: 3 days is hard for an appliance that needs a maintenance window, and a rushed patch can break production. The directive’s answer is the one we would give a board. When patching in 3 days is impossible, removing the exposure in 3 days is not, and it counts. What Indian rules say about the patch clock India’s best-known cyber clock is about reporting, not fixing. CERT-In’s Directions of 28 April 2022 require service providers, intermediaries, data centres, companies and government bodies to report listed incidents “within 6 hours of noticing such incidents”.[9] They set no deadline for applying a patch. An exploited flaw left open simply becomes the incident that starts the 6-hour clock. The RBI’s Master Direction on IT governance (7 November 2023) asks regulated entities to apply patches “in a secure and timely manner” and to fix flaws found in testing “in a time-bound manner”, with no number of days.[10] SEBI’s Cybersecurity and Cyber Resilience Framework (20 August 2024) does give one, but not to everyone. Every regulated entity must set its own timeframe for each category of patch “in a timely manner”. Market infrastructure institutions and Qualified REs must apply patches at both primary and DR sites within 1 week for High, 2 weeks for Moderate and 1 month for Low criticality, and emergency patches “within timelines as stipulated by the OEMs”.[11] For an entity that another regulator also supervises, SEBI’s clarification of 28 August 2025 limits that clock to systems used only for SEBI-regulated activity.[12] None of these rules asks whether a flaw is being exploited, and none distinguishes an internet-facing system from an internal one, which is the whole of CISA’s new logic. The strictest written Indian number is SEBI’s 7 days for a High patch, and it binds a small set of capital-market firms. For everyone else the action is to write the four tiers above into the policy the RBI or SEBI already requires you to have, and to report it to the board or IT committee that approves it. How we did this Figures as of 6 July 2026 KEV counts are ours. We took CISA’s catalogue in JSON, kept the 1,631 entries with a `dateAdded` on or before 6 July 2026, and computed `dueDate` minus `dateAdded` in calendar days. Buckets: 3 days or less; 4 to 14 days; 21 days; nothing between 15 and 20 or above 21 occurred in the periods charted. Medians are per calendar year or month. We assume CISA did not change the due dates of entries after adding them. BOD 26-04’s Table 1 is published as an image and was read from it. The Verizon figures on remediation (26%, 38%, 43 days) are as Help Net Security reported them; Verizon’s page confirms the 31% figure. Exposure, automation and impact for individual KEV entries were not reconstructed: the catalogue gives one due date per entry, which CISA sets for the worst case it has evidence of. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (incl. Appendix A, Table 1: Remediation Timelines)](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk) — 10 June 2026 2. [CISA, BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk (FAQ on the KEV due date)](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk) — 10 June 2026 3. [CISA, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (now revoked), with its FAQ](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities) — 3 November 2021 4. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed: entries added 1 January 2023 to 6 July 2026 (TechBag count)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — entries dated to 6 July 2026 5. [CISA, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems (now revoked)](https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems) — 29 April 2019 6. [CISA, V1: ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems (original directive 25 February 2026)](https://www.cisa.gov/news-events/directives/v1-ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems) — 11 March 2026 7. [Verizon, 2026 Data Breach Investigations Report (31% of breaches began with exploited vulnerabilities)](https://www.verizon.com/business/resources/reports/dbir/) — 2026 edition 8. [Help Net Security (Brian Honan): Lessons for organizations from the Verizon 2026 Data Breach Investigations Report](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026 9. [CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 2000 (direction (ii): six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 10. [RBI, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, RBI/2023-24/107, paras 13 and 26](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12562) — 7 November 2023 11. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, standard PR.MA.S3](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024 12. [SEBI, Clarifications to CSCRF for REs regulated by other regulators, SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119 (Table 1: patch management timelines), via TaxGuru reproduction](https://taxguru.in/sebi/sebi-clarifies-cybersecurity-rules-entities.html) — 28 August 2025 Related on TechBag: the [vulnerability and exposure management guide](https://www.thetechbag.com/browse/security/vulnerability-management) compares the scanners that tag assets and prioritise by exploitation; the [RMM and patch guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) covers the tools that apply the fix; the [BFSI obligations register](https://www.thetechbag.com/industries/bfsi/obligations) tracks the RBI and SEBI duties cited here. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Vulnerability & exposure management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that tag exposed assets and rank flaws by exploitation - [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the tools that apply the fix inside a 3-day window - [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the patch and reporting duties cited in the India section