CISA’s Patch Deadlines Fell From 21 Days to 3: Watch the KEV Feed With a Short Python Script

The CISA Known Exploited Vulnerabilities catalog, the KEV list, is the shortest and most useful patch list on the internet. Every entry has evidence of real-world exploitation. What changed in 2026 is the clock attached to it. I pulled the live feed on October 21 and counted: in the first half of 2025, 129 of 132 new entries gave a 21 day deadline. Since July 1, 2026, 99 of 124 give 3 days.

Those deadlines legally bind US federal civilian agencies, not you. But they are the best public signal of how fast CISA believes attackers move, and the catalog is free. This post gives you a short Python script that checks it every day for the vendors you run, with the real output from this week.

Quick guide

1. Download the JSON feed from CISA. It is one file and needs no account.
2. Filter by date added so you only see what is new.
3. Filter by vendor so you only see what you run.
4. Run it on a schedule and send yourself the result.
5. Patch in order of due date, and check internet-facing products first.

Why the deadline matters to you

Under CISA Binding Operational Directive 22-01, federal agencies must fix every KEV entry by the due date in the catalog. The due date is chosen by CISA per entry. For you, the date is a free urgency score. A 3 day date means CISA expects imminent or ongoing attacks, and your own internet-facing exposure deserves the same treatment.

I measured how the dates have moved, using the same feed and a second small script, shown after the first.

Step 1: the daily watch script

This uses only the Python standard library, so it runs on any server with Python 3. Edit the WATCH list to the vendors in your estate. It prints the entries added in the last N days (14 by default) for those vendors, newest first.

import json
import sys
import urllib.request
from datetime import date, timedelta

URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
WATCH = ("microsoft", "fortinet", "cisco", "palo alto", "vmware", "citrix", "ivanti", "linux", "apache")
DAYS = int(sys.argv[1]) if len(sys.argv) > 1 else 14

with urllib.request.urlopen(URL, timeout=30) as r:
    kev = json.load(r)

since = (date.today() - timedelta(days=DAYS)).isoformat()
new = [v for v in kev["vulnerabilities"] if v["dateAdded"] >= since]
mine = [v for v in new if any(w in v["vendorProject"].lower() for w in WATCH)]

print(f"catalog {kev['catalogVersion']}, {kev['count']} entries, {len(new)} added in the last {DAYS} days, {len(mine)} from watched vendors")
for v in sorted(mine, key=lambda x: x["dateAdded"], reverse=True):
    print(f"{v['dateAdded']}  due {v['dueDate']}  {v['cveID']:<16} {v['vendorProject']} {v['product']}")

I ran it against the live feed on October 21, 2026. The catalog was version 2026.10.20 and held 1,754 entries. Twenty were added in the previous 14 days, and six belong to the vendors on my watch list.

Read the due dates, not only the product names. Each of those six entries was due only three days after it was added. They include the Windows Shell flaw that was fixed on Patch Tuesday (I wrote about that patch in my October Patch Tuesday post), a Palo Alto Networks PAN-OS management interface bug and a Cisco Secure Email Gateway bug, both added on October 14. NeoTeo reported the same four-entry batch.

One entry deserves a second look. The Apache Struts line is CVE-2016-3081, a ten-year-old identifier that CISA added on October 8, 2026. A flaw being old does not mean attackers stopped using it, and a forgotten Struts application is exactly what this list exists to catch.

Step 2: measure the deadlines yourself

curl -s -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

This second script reads that kev.json file and groups the gap between dateAdded and dueDate by half-year. It is how I got the numbers at the top.

import json
from collections import Counter
from datetime import date

with open("kev.json") as f:
    entries = json.load(f)["vulnerabilities"]

periods = [
    ("2025 Jan-Jun", "2025-01-01", "2025-07-01"),
    ("2025 Jul-Dec", "2025-07-01", "2026-01-01"),
    ("2026 Jan-Mar", "2026-01-01", "2026-04-01"),
    ("2026 Apr-Jun", "2026-04-01", "2026-07-01"),
    ("2026 Jul-Oct", "2026-07-01", "2026-11-01"),
]

print(f"{'period':<14}{'most common deadline':<24}{'share'}")
for name, start, end in periods:
    days = Counter()
    for v in entries:
        if start <= v["dateAdded"] < end:
            days[(date.fromisoformat(v["dueDate"]) - date.fromisoformat(v["dateAdded"])).days] += 1
    top, n = days.most_common(1)[0]
    print(f"{name:<14}{str(top) + ' days':<24}{n} of {sum(days.values())}")

The trend is clear. The standard deadline was 21 days through 2025, started to split in early 2026 and is now mostly 3 days, with 14 days for the rest. I do not know why CISA changed it, and I would not guess. I only know what the feed shows.

Step 3: run it every day

A cron job that mails you only when something matches is enough. This line runs at 07:00 and reads the last 2 days. It needs a working mail command, so use your own notification tool if you do not have one.

0 7 * * * python3 /opt/kev/kevwatch.py 2 | grep -q CVE && python3 /opt/kev/kevwatch.py 2 | mail -s "New KEV entries" [email protected]

I tested the script, not the cron line. The cron line is a pattern, and the address is a placeholder.

What to do when a line appears

1. Check whether you run the product. The vendor filter is broad, so a Cisco entry may not touch you.
2. Check exposure first. A management interface on the internet, as in the PAN-OS entry, is the most urgent kind.
3. Patch or mitigate within the due date if the product is exposed, and note the reason if you cannot.
4. Record it. An auditor will ask how you decided.

Limits of this approach

• The feed lists what CISA has evidence for. A flaw can be exploited long before it appears there.
• Vendor names in the feed are free text, so a watch list can miss a differently spelled name. Review the unfiltered count now and then.
• The script reports and does not patch. Pair it with your own inventory.

FAQ

Do I have to follow the KEV deadlines?

Only US federal civilian agencies are bound by them. Everyone else can use them as a priority signal.

How often is the catalog updated?

In the feed I downloaded, the release timestamp was October 20, 2026 at 19:00 UTC. Entries arrive in batches on working days, so a daily check is enough.

Is the feed free?

Yes. It is a public JSON file on the CISA site and needs no login.

Does a KEV entry mean I am compromised?

No. It means the flaw is known to be exploited somewhere. Whether you are exposed depends on the product and your configuration.

Sources

• Known Exploited Vulnerabilities Catalog, CISA
• KEV catalog JSON feed, CISA
• BOD 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities, CISA
• CISA added four exploited flaws to the KEV catalog, NeoTeo