WASHINGTON, 11 AUG 2026 — Six vulnerabilities entered the United States government's Known Exploited Vulnerabilities catalogue in the first week of August. Every one carried the same remediation deadline: three days.
For most of that catalogue's life the deadline was three weeks. The change did not arrive with a press release, and outside federal IT almost nobody marked the day it happened. It is now the default.
We referred to that three-day clock in passing when SonicWall's gateway went into the catalogue. This is where it comes from, and what it now costs to meet.
What the catalogue says about itself
The KEV catalogue ships as a JSON feed. Every entry records the date CISA added the vulnerability and the date federal agencies must have it remediated by. The gap between those two dates is the deadline, and it is the one number in the file nobody puts in a headline.
We took the snapshot published on 10 August — catalogue version 2026.08.10, 1,662 entries — and measured that gap for every entry that has one.
Of the entries added before 2026, 981 carry a 21-day deadline. That was the standard the previous directive set for anything newly catalogued. Another 257 sit at roughly six months, which is the grace period the 2021 directive gave the several hundred older vulnerabilities it listed on its first day.
The 14-day tier appears in March and holds through May. By June, the median is three days. In the first week of August, it was the only deadline given, applied to all six new entries: N-able N-central (twice), Apache Tomcat, IBM Langflow, JetBrains TeamCity, and Progress LoadMaster.
Where three days comes from
The mechanism is Binding Operational Directive 26-04, issued on 10 June 2026. It supersedes and revokes both BOD 22-01, which created the KEV catalogue in November 2021, and BOD 19-02 from 2019. The first catalogue entry citing the new directive appears the following day.
Timelines now come from a table keyed to the Stakeholder-Specific Vulnerability Categorization system, which weighs whether a vulnerability is being exploited, how much control it hands an attacker, and whether the affected asset is reachable from the internet. Known exploitation plus public exposure lands in the fastest tier.
That tier carries a requirement the old regime never had. The directive spells it out: the phrase "& forensic triage" in its timeline table means an agency must complete the fix within three days and "carry out a forensic triage of the asset to assess whether the system is compromised."
So the three days is not a patching window. It is a patching window with an incident investigation attached, on the working assumption that anything exploited in the wild and exposed to the internet may already have been used against you.
The week the rule was tested
The first week of August shows how this works in practice. Entries arrived on four separate days, each starting its own three-day clock.
Two of those deadlines fell on a Saturday and one on a Sunday. The directive counts calendar days, and says so.
The failed patch that beat its own bug into the catalogue
The N-able pair is worth reading slowly, because the order is strange and it is not a clerical error.
CVE-2026-18577 was added on Monday 3 August. CISA's own description of it says the flaw "is the result of an incomplete patch for CVE-2026-18556." That original vulnerability was added the next day, on 4 August.
The fix that did not work was catalogued as an actively exploited vulnerability a day before the thing it had failed to fix. Both carry a CVSS score of 8.2, both are authentication bypasses, and both were addressed in version 2026.3 HF1.
N-central is remote monitoring and management software, which is to say it is the console a managed service provider uses to reach its customers' machines. According to The Hacker News, successful exploitation gives an attacker administrative access to the N-central server, from which the product's built-in Take Control feature becomes a route into every endpoint that server manages. Huntress reported seeing the flaw targeted across multiple organisations, without signs of a broad indiscriminate campaign.
This is exactly the problem the three-day tier exists for: the gap between a vendor's incomplete fix and its complete one is a window an attacker is already using.
What it means outside the federal estate
Binding Operational Directives bind federal civilian agencies. They do not bind a company in Singapore, and nothing here creates an obligation for one.
What they do is set a public benchmark. When CISA judges that an exploited, internet-facing vulnerability warrants three days and a compromise assessment, that judgement is available to any organisation deciding what its own service-level target should be, and it is a good deal harder to argue for thirty days than it was in May.
The practical difficulty is not the patch. Most organisations can deploy a vendor hotfix inside three days if somebody decides it matters. The forensic triage is the part with no shortcut, because it needs logs that were being retained before the vulnerability was announced, and an idea of what normal looks like on the affected system. Neither can be acquired after the clock starts.
What to watch
The directive commits CISA to reassessing these timelines once per fiscal year, and to running case studies on whether "technological or adversarial advances warrant further reductions." Three days is not stated as a floor.
Watch also for what a three-day deadline does to disclosure. A vendor that ships an incomplete patch now puts its federal customers into a compressed remediation cycle twice, and N-able has just demonstrated what that looks like from the outside.
View author profile → · Editorial policy
