Average Time to Patch Vulnerabilities: 2026 Report

Bottom Line

Of the 139 flaws CISA added to the KEV catalog from June 11 to October 23, 2026, 113 carry a deadline of 3 days or less. Microsoft products accounted for 40 of the 272 entries added in 2026, more than twice as many as any other vendor. In 2026 industry reports, the headline averages and medians from Verizon, Cobalt, Synack and Edgescan for fixing known exploited or high-severity findings run from 38 to 58 days.

How Long Agencies Get to Patch Known Exploited Vulnerabilities

This section sets out the remediation windows in our KEV dataset by the year each flaw was added. The window is the number of calendar days between the date a flaw entered the catalog and the date CISA required federal civilian agencies to fix it.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23. Data: kev-remediation-windows-by-year.csv

• The 21-day window covered more than 92% of entries added in each year from 2023 to 2025, so a federal agency could expect about three weeks to patch most new KEV flaws.
• In 2026, 52.9% of new entries carried a 3-day window, and the median window fell to 3 days.
• Long windows of 180 days or more appear only in the first two years, when CISA loaded older vulnerabilities into the new catalog. Of the 311 entries added in late 2021, 64.3% had a window of 180 days or more.

Binding Operational Directive (BOD) 22-01, the order that created the catalog in November 2021, set default deadlines of six months for vulnerabilities with a CVE ID assigned before 2021 and two weeks for all others, and allowed those timelines to be adjusted in the case of grave risk. In practice, CISA set 21 days for most new entries from 2022 onward. Across all 1,445 entries added from 2022 through October 23, 2026, the median window was 21 days. On June 10, 2026, CISA replaced BOD 22-01 with BOD 26-04, which sets the shorter deadlines seen in the 2026 row.

The mean window for 2026, 9.2 days, is well above the median because 14-day and 21-day windows were still common in the first five months of the year, before the new directive.

CISA also flags whether a KEV entry is known to have been used in ransomware campaigns. In our dataset, 361 of the 1,756 entries carry that flag, counted as of the October 2026 download.

How Quickly New Flaws Reach the KEV Catalog

This section measures the days between a CVE's publication in the NVD and its addition to the KEV catalog. The lag matters because a flaw can be public for weeks or months before it enters the catalog. Under BOD 26-04, an agency's deadline starts when CISA adds the flaw to the catalog or when the agency finds the flaw on one of its own systems and records it, whichever happens first.

We limited the main measure to recent CVEs, meaning CVEs published no earlier than the year before the flaw was added to the catalog. Older CVEs added years after publication would otherwise dominate the median.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23, and NVD CVE publication dates. Data: kev-publish-to-add-lag.csv

• Since 2023, about half of recent CVEs reached the KEV catalog within a week of publication, and the median lag stayed between 4 and 7 days.
• For recent CVEs added in 2026, the median time from NVD publication to the federal due date was 18 days, down from 27 days in 2024 and 2025.
• In 2026, 56 recent CVEs entered the catalog on or before the day their NVD record was published. For those flaws, agencies could not wait for the NVD entry before starting work.

Across all years, 65 entries in the dataset were added to the KEV catalog before their NVD publication date. In those cases the federal deadline started before the NVD record for the flaw was public.

VulnCheck, which runs its own catalog of exploited vulnerabilities, reported in July 2026 that the median time from CVE publication to addition to its catalog fell from 120 days in 2025 to 80 days in the first half of 2026. It also found that 23.43% of the 495 vulnerabilities it added in the first half of 2026 showed evidence of exploitation on or before the day the CVE was published, compared with 28.93% in 2025.

How 2026 Deadlines Changed Month by Month

This section breaks down 2026 KEV additions by month and window length, with June split at June 10, 2026, the day CISA issued BOD 26-04. It shows when the 3-day and 14-day windows replaced the 21-day default, and how many entries cite BOD 26-04 in the required action text CISA writes for each entry.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23. Data: kev-2026-monthly-windows-june-split.csv and kev-2026-before-after-bod-26-04.csv

• The 21-day window disappeared from new entries after March 2026. From March through May, 14 days was the most common window.
• June 11, 2026 was the first day an entry cited BOD 26-04. From then through October 23, the median window was 3 days and the mean was 5.1 days, against a median of 14 days for the 133 entries added between January 1 and June 10.
• Since the directive, 14-day windows have made up a minority of each month's entries, so an agency that plans its patch cycle around two-week deadlines will miss most new KEV dates.

The shift started before the new directive. All 89 entries added between January 1 and June 10, 2026 with windows of 14 days or less cited BOD 22-01 in their required action text, but that citation appears in every entry from the period, so it says little about why the windows shortened. Cisco SD-WAN entries added in February, April and May cited Emergency Directive 26-03, which CISA issued for those devices. September 2026 was the busiest month of the year, with 43 additions, and every one of them cited BOD 26-04.

KEV Deadlines by Vendor in 2026

This section breaks down the 272 KEV entries added in 2026 by vendor, using the vendor field CISA records for each entry. It covers the 10 vendors with five or more entries, how long their deadlines were, how their deadlines changed after June 10, and how many vendors appear in the catalog each year.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23, vendorProject, dateAdded, dueDate and forensicTriage fields. Synacor makes the Zimbra Collaboration Suite. Data: kev-2026-top-vendors.csv

• Microsoft's median window was 14 days, longer than the 3-day median for all 2026 entries, because 27 of its 40 entries were added before June 11, when 14-day and 21-day windows were still common.
• Cisco, Fortinet, Linux, Ivanti and Citrix each had a median window of 3 days. Their 2026 entries include flaws in Cisco Catalyst SD-WAN Manager, Citrix NetScaler, Ivanti Endpoint Manager Mobile and the Linux kernel.
• The 95 vendors outside the top 10 account for 57.4% of the year's entries, and their median window was 3 days, the same as for all 2026 entries.

At the product level, Windows had the most 2026 entries, 14, followed by the Linux kernel with 8. Microsoft SharePoint had five entries, all with windows of 3 days, and four of them came after June 10. JFrog Artifactory, new to the catalog in 2026, had four entries, all added after the directive, with a median window of 14 days.

Some KEV entries are marked for forensic triage, a check of whether attackers already used the flaw against the agency's systems. The first entry CISA marked for forensic triage was added on June 25, 2026, and through October 23, 91 entries carry that mark. Fortinet had five of its nine 2026 entries marked, and Linux had five of its eight.

Of the 27 entries added in 2026 that CISA marks as known to have been used in ransomware campaigns, Microsoft had 4 and Cisco had 2. The other 21 came from vendors with fewer than five entries in 2026, so most 2026 entries with known ransomware use came from vendors outside the top 10.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23. Vendors shown have at least three 2026 entries in each period. Data: kev-2026-vendors-before-after-bod-26-04.csv

• Microsoft's median fell from 14 days before the directive to 3 days after it, and 9 of its 13 later entries carry a window of 3 days or less.
• Google is the only vendor in the table whose median stayed at 14 days after June 10. Four of its eight 2026 entries are flaws in Chromium V8, the JavaScript engine used in the Chrome browser.
• Cisco and Fortinet entries already carried 3-day windows before the directive, so for agencies that run those products, the new rules changed little about the deadlines they face.

Source: CyberReviewed analysis of the CISA KEV catalog, version 2026.10.23, vendorProject and dateAdded fields. A vendor is new to the catalog in the first year its vendor name appears. Data: kev-vendor-breadth-by-year.csv

• Entries added in 2026 came from 105 vendors, more than in any earlier year, and 64 of those vendors had a single entry.
• Microsoft had the most entries in every year, but its share of new entries in 2026 was about half its 2022 share.
• New vendors in 2026 include JFrog, MLflow, n8n and Vite. A patch program built around a few large vendors now covers a smaller share of new KEV entries than it did in 2022.

What BOD 26-04 Requires

This section sets out the deadline rules in BOD 26-04, "Prioritizing Security Updates Based on Risk," which CISA issued on June 10, 2026. The directive revoked and superseded BOD 22-01 and BOD 19-02. It sets remediation deadlines for federal civilian agencies based on four questions: whether the asset is publicly exposed, whether the flaw is in the KEV catalog, whether exploitation can be automated, and whether a successful attack gives partial or total control of the system.

Source: CISA, BOD 26-04, Table 1. Timelines are in calendar days. Data: bod-26-04-timelines.csv

• Every KEV flaw has a deadline of 3 or 14 days. On a publicly exposed asset, a KEV flaw gets 3 days unless exploitation cannot be automated and the impact is partial.
• Flaws outside the KEV catalog had deadlines before, under BOD 19-02, which set 15 days for critical and 30 days for high-severity flaws on internet-facing systems. Under the new table, a publicly exposed, automatable flaw with total impact gets 3 days even if no exploitation has been confirmed.
• Three of the 16 combinations add forensic triage to the 3-day fix, so in the most serious cases a patch alone does not meet the directive.

The directive rolls out in three phases, and by 180 days after issuance, agencies must fix flaws within the Table 7 timelines. CISA must review the timelines once each fiscal year. The due dates in the KEV catalog are the dates CISA sets for each entry, which may not match the date any single agency completes its fix.

How Long Organizations Take to Fix Known Exploited Vulnerabilities

This section compares federal deadlines with the time organizations take to fix KEV flaws, using Verizon's 2026 DBIR. Its figures come from scan data covering more than 13,000 organizations and count every KEV entry found in those environments by the end of 2025.

Source: Verizon, 2026 Data Breach Investigations Report, Figures 12 to 14 and pages 17 and 18. Remediation status n=515,170 KEV vulnerabilities; days to remediation n=10,597 organizations; CVEs per organization n=13,773 organizations. Data: dbir-kev-remediation.csv

• The share of KEV flaws fully fixed fell from 38% to 26%, and the median time to full remediation rose by 11 days.
• Organizations had a median of 16 KEV vulnerabilities to fix in 2025, compared with 11 in 2024.
• The 43-day median is more than twice the 21-day federal window that applied to most KEV entries in 2025, and it is longer still against the 3-day and 14-day windows in place since June 2026.

Verizon also measured the share of KEV vulnerability instances still open at set intervals after detection, using more than 1 billion anonymized records from Qualys. In the 2025 data, 35% of instances were still open at day 28, up from 27% a year earlier. Verizon writes that between 60% and 70% remain open after seven days regardless of year (its chart shows 71% for the 2023 data), a possible ceiling on how fast remediation can move, and that the long tail settled at 9% of instances, about 47 million open vulnerabilities.

Data: dbir-kev-survival-curve.csv

Qualys reported in May 2026 that the median time from detection to closure in its data held steady at 9 days. Verizon's 43 days is the median across organizations of the time to fix a KEV CVE on every affected system, so one server can be fixed within days while the last one in the same company stays open for weeks.

Verizon's data also shows how much the number of flaws to fix has grown. It counts 527.3 million KEV vulnerability instances in the 2025 data, almost eight times the 68.7 million in the 2022 data. At day 28, 184 million instances were still open, up from 31 million in 2022. Defenders fixed 63.7 million instances before CISA added the CVE to the catalog, up 30% from 48.9 million in 2024, but a smaller share of the total than a year earlier.

Time to Fix by Source and Sample Type

This section sets published time-to-fix figures from five 2026 reports side by side. The data ranges from scans across thousands of companies to a single vendor's penetration test findings, so rows measure different populations and should be compared for direction only.

Sources: Verizon, Qualys, Cobalt, Synack and Edgescan 2026 reports. Data: industry-time-to-fix-by-source.csv

• Synack's customers cut average remediation time for critical findings from 63 days in 2024 to 38 days in 2025, and for high findings from 100 to 58 days.
• Edgescan's customers fixed high and critical device and network findings faster on average than application and API findings, 39 days against 54.8.
• Only the Qualys median falls inside the 14-day BOD 26-04 deadline for KEV flaws, and no figure falls inside 3 days, so meeting the federal deadlines would mean fixing serious flaws several weeks faster than these organizations do now.

Cobalt and Synack both report fix times by severity, and both show critical findings fixed fastest. Cobalt's survival analysis, which counts findings that were never fixed, puts the half-life of critical pentest findings, the time to resolve half of them, at 38 days, against 81 days for high and 243 days for medium findings.

In Edgescan's data, high and critical findings with an Exploit Prediction Scoring System (EPSS) score above 0.7 took an average of 134.3 days to fix, against 210 days for those below 0.1. Edgescan reads this as a sign that teams still prioritize by CVSS severity score more than by exploit likelihood or KEV status.

Remediation Time by Industry

This section compares average remediation times by industry from the two reports that publish them. Synack reports critical and high findings for five sectors, and Edgescan reports average days to remediate vulnerabilities for 14 sectors.

Source: Synack, 2026 State of Vulnerabilities Report, overall chart and sector pages. Data: synack-mttr-by-sector.csv

• Government clients cut the average time to fix critical findings by 34 days, from 86 to 52.
• Technology and Retail were the two sectors in the table where critical findings took longer in 2025. Technology rose from 74 to 98 days and Retail from 26 to 37.
• Even after that cut, government clients took more than three times as long as the 14-day federal deadline to fix critical findings.

Synack also reports that manufacturing clients cut the average time to fix critical findings by 43 days and high findings by 78 days, the largest improvement of any sector it covers.

Edgescan's sector figures come from its customer base and 2025 data. Construction averaged 123.1 days and software companies 55 days, and government ranked third slowest at 93.2 days. Every one of the 14 sectors averaged more than 50 days.

Data: edgescan-mttr-by-industry.csv

Both reports describe their own customers, so sector figures reflect who buys each service as much as how each industry patches.

How Remediation Targets Compare With Results

This section compares the patch deadlines organizations set for themselves with the time they take. Cobalt surveyed 450 security leaders and practitioners about their service-level agreement (SLA) targets and set the answers against its pentest data.

Source: Cobalt, State of Pentesting Report 2026, Figures 14, 15 and 18. Shares are as published and sum to 99% because of rounding. Data: cobalt-sla-and-half-life.csv

• More than half of respondents, 52%, target a fix for critical findings within a week (our calculation from the 33% and 19% shares).
• The median organization's 39-day resolution time is longer than every SLA band respondents reported.
• A third of respondents already set critical SLAs of 3 days or less, the same length as the shortest BOD 26-04 deadline, yet only the fastest 10% of organizations average 13 days or fewer to resolve high-risk findings.

Cobalt's yearly figures for the median organization's mean time to resolve high-risk findings rose from 41 days in 2021 to 46 in 2024, then fell to 28 days in 2025. Cobalt says the 2025 drop is partly an artifact, because 2025 findings have had less time to be resolved.

What the Patch Timelines Mean

Federal agencies now have 3 or 14 days to fix each new KEV flaw, depending on whether the affected system is publicly exposed, whether exploitation can be automated and whether an attack would give partial or total control of the system. For most new entries, the due date now comes weeks before the organizations in the industry reports typically finish fixing serious flaws. Meeting those dates means an agency has to know which of its systems face the internet before a flaw is announced, and it needs staff who can patch a system and check it for signs of attack in the same week.

Security teams outside government face the same flaws without the same rules. The industry data shows organizations fixing many affected systems quickly and leaving others open for weeks or months, while the number of exploited flaws on their networks keeps rising. A team that tracks only its average fix time can miss the last unpatched servers, which are the ones attackers can still reach.

The required action text in each KEV entry tells agencies to apply the vendor's mitigations, or to stop using the product if no mitigations are available. How quickly a vendor publishes a fix or mitigation therefore affects whether agencies can meet their deadlines.

So if you are setting or reviewing a patch SLA, compare it with the 3-day and 14-day BOD 26-04 deadlines for known exploited flaws and measure how long your team takes to fix every affected system.

Sources

1. CyberReviewed, Vulnerability Patch Time Study: analysis of all 1,756 entries in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.23) and their NVD publication dates, with published remediation times from Verizon, Qualys, Cobalt, Synack and Edgescan compiled by source, severity and industry, conducted October 2026. Data: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json and https://services.nvd.nist.gov/rest/json/cves/2.0?hasKev
2. CISA, BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026
3. CISA, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities (Revoked), November 3, 2021
4. CISA, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems (Revoked), April 29, 2019
5. Verizon, 2026 Data Breach Investigations Report
6. Qualys, "Inside the 2026 Verizon DBIR: What One Billion Records Revealed About Vulnerability Remediation," May 19, 2026
7. Cobalt, State of Pentesting Report 2026
8. Synack, 2026 State of Vulnerabilities Report
9. Edgescan, 2026 Vulnerability Statistics Report
10. VulnCheck, "VulnCheck State of Exploitation 1H-2026," July 28, 2026

Data Collection and Methodology

BOD 26-04 applies to federal civilian executive branch agencies and does not cover national security systems or certain systems operated by the Department of War or the Intelligence Community.

KEV dataset. We downloaded the full KEV JSON feed on October 24, 2026 (catalog version 2026.10.23, 1,756 entries, dates added from November 3, 2021 to October 23, 2026). The remediation window is the dueDate minus the dateAdded, in calendar days. Shares in Table 1 are each window length's share of that year's entries. Ransomware counts use the catalog's knownRansomwareCampaignUse field as of the download date. BOD 26-04 citations were counted by searching each entry's requiredAction text. The June split in Table 3 puts entries added June 1 to 10 before the directive; no entries were added on June 10.

Vendor breakdown. Vendor counts use the catalog's vendorProject field, with leading and trailing spaces removed and no other changes, so a vendor recorded under two spellings counts as two vendors. Table 4 shows vendors with five or more entries added in 2026. Table 5 shows vendors with at least three entries both before and after June 10, 2026, so that a single entry does not set a vendor's median. A vendor is new to the catalog in the first year its name appears in vendorProject. Forensic triage counts use the forensicTriage field; the first entry marked Yes was added on June 25, 2026. All 139 entries added since June 11 cite "Forensics Triage Requirements" in their required-action text, including the 48 not flagged, so the count of 91 comes from the forensicTriage field alone. Product counts group entries by vendorProject and product and are in kev-2026-top-products.csv.

Publication lag. We matched all 1,756 CVE IDs to their NVD published dates through the NVD API's hasKev query; every entry had a published date. The lag is dateAdded minus the NVD published date. Recent CVEs are those published no earlier than the year before the year of KEV addition, including CVEs published after their KEV addition date. Negative lags, where CISA added a CVE before its NVD record was published, are kept and counted as added on or before publication day. The lag is measured from the NVD publication date, which can fall after a vendor's own advisory.

Industry figures. Each source's measure is reported as published, including whether it is a mean, a median, a median of means or a survival half-life. Verizon's remediation figures come from its vulnerability management data. Chart 2 values were read from the data labels in Verizon's Figure 15. Cobalt half-life values were read from the labels in its Figures 17 and 18, and yearly values from Figure 16. Edgescan's text gives software a 53-day average while its industry chart shows 55 days; we use the chart value. Banking rounded from Edgescan's published 72.87. Synack's overall severity values were read from its chart labels, and sector values come from the sector pages' text. Manufacturing averages are not shown in Table 10 because the sector page text gives only the size of the change. The 52% share in Table 11 is our calculation. Figures from different reports measure different populations and should not be averaged together.