Patch Tuesday dates and how to schedule around KEV deadlines

What the documents cover and what they leave out

The question has two parts: which day Patch Tuesday falls on, and how to line up a monthly patch calendar with KEV remediation due dates. The three documents supplied are CISA alerts dated October 23, October 28 and October 30, 2026. None of them mentions Patch Tuesday. None of them gives a remediation due date for any KEV entry.

This guide therefore cannot give you the Patch Tuesday rule or a deadline formula. Stating either would mean writing from outside the documents. What follows is what the alerts do say about KEV additions, the federal directive behind them, and how CISA tells organizations to prioritize. Treat it as the input to your calendar decision, not a finished calendar.

What CISA added to the KEV Catalog in the October 2026 alerts

On October 23, 2026, CISA announced one addition. The alert says, "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog". The entry is listed as "CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability".

On October 28, 2026, CISA announced two more. The alert says, "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog". One is "CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability". The other is "CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability".

On October 30, 2026, CISA announced two Ivanti Connect Secure entries. One is "CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability". The other is "CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability".

Across those three alerts, five vulnerabilities were added in eight days. CISA published each one on its own date rather than in a monthly batch.

Additions arrive on CISA's timing, not on a monthly cycle

The alerts show KEV additions landing on October 23, October 28 and October 30, 2026. That is a fact about the dates in these documents only. It does not tell you how the additions relate to any vendor's release schedule, because the documents never discuss vendor schedules.

What a security leader can take from it is limited to what the documents show. A KEV addition is announced on the day CISA posts it. A calendar built only around one fixed monthly date would not have a slot for entries announced on October 23, 28 or 30. The documents do not say how to handle that gap, so this guide does not either. Your team will need to decide it using a source that covers vendor release dates and any due dates attached to individual entries.

What BOD 26-04 requires of federal agencies

Each alert points to the same directive. It reads, "Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies."

The alerts describe what the directive asks. CISA says BOD 26-04 "requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities". The alerts narrow that to CVEs listed in the KEV Catalog "on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities".

Two points follow from that wording. First, the priority is tied to a KEV listing combined with exposure and the level of control an attacker gains. A KEV listing alone is not described as the full test. Second, the directive allows deferral of lower-risk vulnerabilities. The alerts do not define "rapid", and they do not give a number of days.

Checking for compromise before the patch

The directive also covers a step beyond patching. The alerts say, "BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied."

For calendar planning, this means the directive treats patching and checking for prior compromise as separate activities. The alerts do not say when the check is required or what it must include, so this guide cannot say whether it belongs in the same monthly window as the patch. The alerts also state that these vulnerability types are "a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."

What CISA says organizations outside the federal government should do

The directive's reach is stated plainly: "While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management". The alerts add that CISA encourages organizations to prioritize remediation of KEV Catalog vulnerabilities.

So for a private company or a state agency, the BOD is not binding according to these alerts. CISA's stated ask is to run vulnerability management by risk and to put KEV entries first. That is the one scheduling principle the documents support: risk and KEV status set the order, and the monthly cycle does not.

CISA also says the catalog will keep growing: "CISA will continue to add vulnerabilities to the catalog that meet the specified criteria". The alerts note that anyone aware of an exploited vulnerability that is not listed can submit it. They give the requirement: "Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance."

What to confirm before you finalize a calendar

Three items are missing from the supplied documents and need another source:

• The day of the month on which Patch Tuesday falls.
• The remediation due date, if any, attached to each KEV entry, including the five CVEs above.
• The number of days BOD 26-04 allows for "rapid" remediation.

Until those are confirmed, the documents support one conclusion. CISA asks agencies to prioritize KEV vulnerabilities on exposed, total-control assets, and it encourages every other organization to do the same on a risk basis. They do not support a specific day-of-month rule or deadline arithmetic.