What a CISA KEV listing requires of non-federal organizations when a vendor patch is unavailable

The short answer

The three CISA alerts reviewed here do not say what to do when a vendor has no patch or offers only a mitigation. They are short notices that a vulnerability was added to the Known Exploited Vulnerabilities (KEV) Catalog. They contain no interim-response steps, no tracking method and no documentation format. This guide sets out what the alerts do say, so a security leader can see where CISA's text ends and where the organization's own policy has to begin.

The alerts are dated October 28, 2026, October 30, 2026 and November 3, 2026. They share the same wording apart from the CVE entries.

What the alerts announce

Each alert opens with a statement that CISA has added vulnerabilities to the catalog. The November 3 alert says CISA has added one new vulnerability to its KEV Catalog, based on evidence of active exploitation. The October 28 and October 30 alerts each cover two vulnerabilities.

The October 28 alert lists a Broadcom VMware ESX insufficient logging vulnerability and a Linux kernel flaw. It names the second as CVE-2026-46300, a Linux Kernel Missing Initialization of a Variable Vulnerability.

The October 30 alert lists two Ivanti Connect Secure entries. One is CVE-2026-111357, described as an Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. The other is CVE-2026-118527, a predictable numbers or identifiers weakness in the same product.

The November 3 alert lists CVE-2026-119977, a WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability.

None of the three alerts states whether a vendor fix exists for any listed entry. A reader cannot tell from these pages whether a patch, a mitigation or neither is available. That has to be checked against the vendor and the CVE record, which the alerts reference but do not summarize.

What CISA says about the risk

Each alert says that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The wording is generic. It does not rate individual entries or give exploitation details for them.

What the directive requires, and of whom

The alerts point to Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." CISA says the directive establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. The alerts summarize it in two parts.

First, CISA says BOD 26-04 requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities. The alerts narrow that to CVEs listed in the KEV Catalog on publicly exposed assets that grant total control of the asset after exploitation. The same text says action is deferred for lower-risk vulnerabilities.

Second, CISA says BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. This is the only point in the alerts that touches on activity before remediation. The sentence is framed around a patch being applied, and the alerts do not extend it to cases where no patch exists.

What applies to everyone else

For organizations outside the federal civilian agencies, the alerts state the position directly. CISA says that while BOD 26-04 applies only to FCEB agencies, it encourages all organizations to adopt risk-based vulnerability management. The same sentence asks them to prioritize remediation of KEV Catalog vulnerabilities.

So the directive's deadlines and its compromise-check expectations are not binding on a private company, a state agency or a school. The alerts frame the KEV listing as a prioritization signal. They do not create a duty to report, a deadline or a required form of record for non-federal organizations.

The alerts also say CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Where "mitigation" appears

The word mitigation appears once in each alert, in the nomination paragraph. CISA invites anyone aware of an exploited vulnerability not yet listed to submit it through its KEV Nomination Form. It then states a condition: potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

This sentence is the closest the alerts come to the question. It describes what a vulnerability needs before it can be added to the catalog. It does not describe what an organization must do after a listing. It does suggest that a KEV entry normally has some mitigation guidance attached, but the alerts do not say where that guidance is published or what it contains.

Documenting and tracking the interim response

The alerts give no instruction on documenting or tracking an interim response, so any method has to come from the organization's own policy or from other sources. The three alerts can anchor a record only through the facts they do supply:

• the CVE identifier and the product or component named in the alert
• the alert's release date, such as October 30, 2026
• CISA's statement that the listing rests on evidence of active exploitation
• whether the asset is publicly exposed and whether exploitation would grant total control, the two conditions BOD 26-04 uses to set the highest priority
• the vendor's or CVE record's statement of what fix or mitigation exists

The first three come directly from the alerts. The fourth restates the directive's criteria as the alerts summarize them. The fifth is something the alerts do not provide and the reader must obtain elsewhere.

The compromise-check expectation in BOD 26-04 is stated for agencies and tied to the patch being applied. How an organization records such a check where no patch exists is not something CISA's alerts address. A leader who wants a documented interim posture should treat the format, owner, review interval and closing criteria as decisions for internal policy. The documents give no figures or formats for any of them.

What to take from the three alerts

CISA's alerts are notices of catalog additions, with a pointer to a federal directive. They state that exploitation is active, that federal agencies face prioritization and compromise-check expectations under BOD 26-04, and that everyone else is encouraged to prioritize KEV entries using a risk-based approach. They do not state what to do when no patch is available, and they do not set any tracking or documentation requirement for organizations outside the federal civilian agencies.