CISA’s exploited-vulnerability catalog in 2026: more additions, and most now due in three days

What the catalog is

CISA set up the Known Exploited Vulnerabilities catalog in 2021 under Binding Operational Directive 22-01, which told federal civilian agencies to remediate the vulnerabilities on it by set dates [3]. On June 10, 2026, CISA issued BOD 26-04, Prioritizing Security Updates Based on Risk, which revokes BOD 22-01 and BOD 19-02 and sets remediation timelines from four questions: whether the asset is publicly exposed, whether the vulnerability is in the catalog, whether exploitation can be automated, and whether it gives an attacker partial or total control [2]. The most urgent cases get three calendar days, plus a forensic triage of the asset to check whether it was compromised [2] [4].

The directives bind federal civilian executive branch agencies [2]. Banks, health systems, and state and local governments are outside them, but the catalog is public and its feed is free to download [1].

More additions than in any year since 2022

Between January 1 and November 13, 2026, CISA added 297 entries, against 220 in the same window of 2025 and 159 in 2024. Only 2022, the catalog’s first full year, saw more.

The deadlines changed in two steps

In 2025, 226 of the 245 entries added during the year carried a due date 21 days after listing. In 2026 the 21-day deadline last appears on an entry added on March 5. Fourteen-day deadlines appear from March 9, and three-day deadlines from January 27, more than four months before BOD 26-04 was issued.

Since June 10, every entry has carried either a 14-day or a three-day deadline, and 128 of the 164 carry three days. Every entry added since June 10 points agencies to BOD 26-04 and to CISA’s forensic triage requirements in its required action [1].

The catalog itself does not say why three-day deadlines began in January, and we have not found a CISA statement that explains it, so we report the dates without a reason.

Whose products

Microsoft accounts for 41 of the 297 entries added in 2026 and Cisco for 21. Four vendors best known for network gateways and remote access, Fortinet, Ivanti, Citrix and Check Point, account for 28 between them.

Mostly new flaws, with a tail of old ones

Of the 297 entries added in 2026, 209 carry a 2026 CVE identifier and 38 a 2025 one. Twenty-one were assigned in 2020 or earlier, the oldest in 2008: attackers were still exploiting them, so CISA listed them this year.

The catalog also records whether CISA knows of a vulnerability’s use in ransomware campaigns. For the 297 entries added in 2026, the field reads “Known” for 27 [1].

What the figures suggest for teams outside the federal government

• A three-day due date is CISA’s judgment that the flaw is exploited and dangerous on exposed systems. Teams that use the catalog to set priorities can treat a three-day entry on an internet-facing asset as an emergency change, and plan for the forensic check the federal directive asks for.
• The volume is rising: at the 2026 rate, a team that patches only catalog entries handles between six and seven a week.
• A vulnerability with an old CVE number can still be added. Asset inventories need to reach older products as well as those under current support.