KEV Remediation Deadline Calculator

Share:
By Checked against sources by , Founder & Architect, RECATOOLS Published Updated Last reviewed

Work out the real working time on a CISA KEV remediation deadline — calendar days, working days after weekends and SG/MY public holidays, weekend due dates.

RT-SEC-009 · Cybersecurity Tools
Your browser is too old for this tool’s interactive features. Please update to Safari 13.1, Chrome or Edge 80, Firefox 74 or newer.

KEV Remediation Deadline Calculator

⚠ Disclaimer: This is a planning aid, not an official CISA tool, and is not affiliated with or endorsed by CISA. The remediation due dates published in the CISA KEV catalogue are authoritative and take precedence over anything computed here. The Singapore and Malaysia holiday sets are a vendored convenience (federal/national baseline) — verify individual dates against the official gazette. Everything runs in your browser; nothing you enter is transmitted unless you share a link, which carries your dates.

CISA's directive states that KEV remediation windows are counted in calendar days — weekends and public holidays included. Enter the date a vulnerability was added and its due date (or window length) to see the working time you actually have. Everything is computed in your browser; this tool never contacts cisa.gov. The catalogue's dates are plain calendar dates with no time of day; "today" here is the date in Singapore.

Which window applies to my asset? (BOD 26-04, Table 1)

CISA sets each catalogue due date from Table 1 using its own evidence on whether the flaw sits on internet-facing systems. The directive leaves the final exposure call to the agency, asset by asset, so one CVE can carry different windows on different machines. Answer for one asset:

—

Automatable and technical impact are published for every CVE by CISA's Vulnrichment programme. The directive binds US federal civilian agencies; for anyone else this is a reference, not an obligation.

📅 Research current as of 03 Nov 2026 · Sources: Calendar days are counted between the two dates, exclusive of the added date. Working days exclude Saturday and Sunday, and — when a region is selected — its gazetted public holidays. BOD 26-04, Appendix A: 'Days are calendar days.' Windows: Table 1 of BOD 26-04 (10 June 2026).
Standards, published formulas, and reference data are revised over time — check against a current authoritative source before relying on these figures.
Advertisement
After tool · AD-W1Responsive

How to Use the KEV Deadline Calculator

Enter the date added

Type the date the vulnerability was added to the CISA KEV catalogue. It is the "Date Added" column in the catalogue entry and the start of the remediation clock.

Give the deadline

Enter the catalogue's due date, or switch to "Window length" and pick the number of days. BOD 26-04 gives catalogue entries 3 or 14 days; 21 was the usual window before March 2026. The window is measured in calendar days.

Choose your region

Leave it on "Weekends only", or select Singapore or Malaysia to also exclude local public holidays and see your team's real working time.

Read the working time

The verdict names the working days you actually have, flags weekend deadlines, and shows the days remaining from today. Copy the link to share the exact scenario.

Advertisement
After how-to · AD-W2Responsive

The Three-Day Clock and Why the Weekday Matters

The clock that arrived before the directive

For most of its life, the CISA Known Exploited Vulnerabilities catalogue — the KEV — ran on a comfortable rhythm. Binding Operational Directive 22-01, issued on 3 November 2021, gave United States federal civilian agencies two weeks for newer flaws and six months for CVEs assigned before 2021, and in practice the catalogue's own due dates settled on 21 days: 226 of the 245 entries added in 2025 carried exactly that window. That number is what many teams still picture when they think of a "KEV deadline," and it is now out of date. The paperwork that gets the credit — Binding Operational Directive 26-04, which revoked 22-01 — was issued on 10 June 2026, but the catalogue had already changed. The first three-day deadline appeared on an entry added 27 January 2026, and the last 21-day windows went to entries added 5 March 2026, three months before the new directive was signed.

What decides three days or fourteen

BOD 26-04 replaced the single window with a table. Four questions set the clock for an asset: is it publicly exposed, is the flaw in the KEV, can an adversary automate the exploit, and does exploitation give total or only partial control. For a KEV flaw the answer is three days when the asset is exposed and the exploit is automatable, or when exploitation gives total control of an exposed asset, or total control through an automatable exploit on an internal one; total control in any of those three cases adds a forensic triage of the asset as well. Every other KEV combination gets fourteen days. CISA computes the catalogue's due date from that table using its own evidence on whether the flaw sits on internet-facing systems, and its implementation guidance says the final exposure call is the agency's, asset by asset. The panel under the window box walks the table for one asset.

"The directive that gets the credit arrived in June 2026. The three-day clock had been running since January."

Why the day of the week now decides your deadline

The shift matters because of a single line most people miss. CISA's directive is explicit: "Days are calendar days." The clock does not pause for weekends, and it does not pause for public holidays. When the window was 21 days, that hardly mattered — a weekend or two was lost in the noise. At three days, it is decisive. A vulnerability added to the catalogue on a Thursday with a three-day window is due on Sunday, which means the only working day inside the window is Friday. Added on a Friday, the window spans Saturday and Sunday and lands on Monday — again a single working day. Of the 119 three-day clocks on entries added between 10 June and 30 October 2026, 43 held exactly one weekday and 49 fell due on a Saturday or Sunday. The weekday a vulnerability is published now quietly decides how much real time a team gets, which is exactly what this calculator makes visible.

There is a regional dimension too. For a security team in Singapore or Malaysia, a deadline that already loses a weekend can lose another day to a public holiday — a three-day clock can contain no working days at all. In Malaysia, an entry added on Thursday 19 March 2026 fell due on Sunday 22 March, and the one weekday in between, Friday 20 March, was the additional Hari Raya Aidilfitri holiday. In Singapore, an entry added on Friday 5 February 2027 falls due on Monday 8 February, the in-lieu day for Chinese New Year. Because the directive counts calendar days, those holidays do not extend the deadline; they simply compress the working time available to respond. The optional Singapore and Malaysia holiday sets in this tool exist to make that real working time visible, so a team can see at a glance whether a deadline that looks like three days is, in practice, an afternoon. The deadlines themselves remain CISA's to set and publish; this tool only does the arithmetic the directive implies, so you can plan staffing and escalation around the working time you actually have rather than the calendar figure that hides it.

What the catalogue did after BOD 26-04

01

Of 149 entries added between 10 June and 30 October 2026, 119 carried a three-day window and 30 a fourteen-day one. No other length appeared.

02

96 of the 149 are marked "forensic triage required", and every one of them is on a three-day clock.

03

43 of the 119 three-day clocks held exactly one weekday between the listing date and the due date.

04

49 of the 119 three-day due dates fell on a Saturday or Sunday.

How we counted: CISA's JSON feed, catalogue version 2026.10.30, entries whose dateAdded falls from 10 June (the date BOD 26-04 was issued) to 30 October 2026. Window = dueDate − dateAdded. Weekdays are Monday to Friday, no holidays removed, the listing day not counted.

Frequently Asked Questions

  • The Known Exploited Vulnerabilities catalogue is a list, maintained by the US Cybersecurity and Infrastructure Security Agency (CISA), of software flaws that are confirmed to be exploited in the wild. Each entry names the CVE, the vendor and product, the date it was added, and a remediation due date. Because everything on it is actually being attacked, it is widely used well beyond government as a prioritisation list for patching.
  • The binding operational directive behind the KEV — BOD 22-01, and from June 2026 its successor BOD 26-04 — legally binds US federal civilian executive-branch agencies. Private companies, and organisations outside the United States, are not legally required to meet the dates. In practice, though, the catalogue has become an industry benchmark: if a flaw is being exploited widely enough for CISA to list it, most security teams treat the due date as a sensible target regardless of whether it binds them.
  • Calendar days. The directive states explicitly that "Days are calendar days," so weekends and public holidays are included in the count and do not extend the deadline. That distinction barely mattered when windows were around 21 days, but with three-day windows now common it is decisive — the working time inside a window can be a fraction of the calendar figure. This tool shows both so you can plan around the working days you really have.
  • When nearly every KEV entry shared a 21-day window, the due date told you nothing extra. Under BOD 26-04 the window comes out of Table 1, so its length carries CISA's answers to the table's questions. A three-day date means CISA's answers landed on one of the table's three-day rows: exposed and automatable, exposed with total control, or automatable with total control. A fourteen-day date means none of them did. The "forensic triage required" flag on the entry says total control was part of that call.
  • The deadline does not pause. BOD 26-04 defines remediation as eliminating the vulnerability "through patching, decommissioning the system, or another action", and each catalogue entry's required action is to apply the vendor's mitigations. The directive also notes that the timeline is dynamic: taking a system off the internet changes its "publicly exposed" answer and can move it to a longer window in Table 1. "No patch yet" is not an extension.
  • Because each entry's window comes from Table 1 of BOD 26-04, and the table's answers differ per flaw: whether it can be exploited automatically, whether it gives total or partial control, and whether CISA has evidence of it on internet-facing systems. Two entries added on 30 October 2026, for example, fell due on 2 November and 13 November. Always read the due date on the specific entry. This tool takes either the due date or the window.
  • Enormously, once windows are short. Because the count is in calendar days, a three-day window that opens on a Thursday or Friday spends most of its length on the weekend and leaves a single working day. The same three-day window opening on a Monday gives three working days. So the publication weekday, entirely outside your control, can triple or third your real response time. Seeing that at a glance is the main reason this calculator exists.
  • No. The calculator never makes a request to cisa.gov or any third-party host from your browser. The optional CVE lookup reads a copy of the catalogue that we download on our server and host on this site; the page fetches the whole file and searches it in your browser, so the CVE you type is not sent anywhere. The lookup result names the copy's date, and an entry added after that date will not be found: type its dates in instead.
  • Weekends are always excluded from the working-day count. Public holidays are excluded only when you select a region — Singapore or Malaysia — from the working-time dropdown. Those holiday sets are a vendored snapshot covering 2025 to 2027. Singapore uses the Ministry of Manpower's gazetted public holidays, including the Monday in lieu when one falls on a Sunday. Malaysia uses the federal table published by the Prime Minister's Department (BKPP), plus New Year's Day and the replacement day owed when a holiday falls on a Sunday; the states add holidays of their own, and Kedah, Kelantan and Terengganu rest on Friday and Saturday instead. They are a planning aid; for anything binding, verify the specific date against the official gazette.
  • No. This is an independent planning aid built by RECATOOLS, not affiliated with or endorsed by CISA. The authoritative source for any deadline is the KEV catalogue entry itself, and CISA's published due date always takes precedence over anything computed here. Use this calculator to understand the working time a deadline implies and to plan around it, then confirm the date against the official catalogue.

Method & sources

How it computes

Window = due date − date added, in calendar days (BOD 26-04: "Days are calendar days"). Working days = days in (added, due] that are not Saturday, Sunday or, if a region is chosen, a Singapore or Malaysia public holiday. Days left count from today's Singapore date. The 3- or 14-day KEV window for one asset comes from BOD 26-04 Table 1 (KevDeadlineKernel).

What this tool implements

  • CISA Binding Operational Directive 26-04 (10 June 2026), Appendix A: "Days are calendar days." The timeline begins when CISA adds the CVE to the KEV catalogue, so a window is the due date minus the date added; weekends and holidays count against it.
  • BOD 26-04 Table 1 (Remediation Timelines), all sixteen rows, held in the kernel: for a KEV flaw, 3 days when the asset is publicly exposed and the exploit automatable, or when exploitation gives total control of an exposed asset, or total control through an automatable exploit on an internal one (the three total-control cases add a forensic triage); 14 days for every other KEV combination.
  • Which date governs: per the BOD 26-04 Implementation Guidance FAQ, CISA computes each catalogue dueDate from Table 1 using its own evidence on whether the flaw sits on publicly exposed assets, and the final exposure call is the agency's, asset by asset. The page shows the catalogue date as the reference and the Table 1 window for the reader's own asset beside it.
  • Dates: the catalogue schema defines dateAdded and dueDate as YYYY-MM-DD with no time of day or zone; they are used as calendar dates only. "Today" is the Singapore date (RecaBusinessDay). Working days exclude the listing day and include the due date.
  • Catalogue figures on the page are counted from CISA's JSON feed, catalogue version 2026.10.30, entries added 10 June to 30 October 2026: 149 additions, 119 three-day and 30 fourteen-day windows, 96 marked forensic triage (all three-day), 43 three-day clocks with one weekday, 49 due on a weekend. 2025: 226 of 245 entries carried 21 days. First three-day entry added 27 January 2026; last 21-day entries added 5 March 2026.
  • Corrected 2026-11-03: five figures credited to "RECATOOLS analysis" with no method (replaced with counted figures and the method); a 21-day quick pick shown as current (now labelled pre-March 2026); BOD 22-01 described as "roughly two to three weeks" (its text says two weeks, six months for CVEs assigned before 2021); working days left over-counted by one when the listing date was still ahead.

Sources

What can make this go out of date

  • Holiday lists run 2025 to 2027 and need a yearly refresh (MOM publishes around June of the year before; BKPP around August); the page warns when a window runs outside them. CISA reviews the Table 1 timelines once per fiscal year under BOD 26-04.
Advertisement
Pre-footer · AD-W3 728 × 90