Who must meet CISA's KEV deadlines, and what non-federal organizations can take from them

The short answer

The three KEV alerts from October 28, October 30 and November 3, 2026 answer the first half of the question directly. CISA's text says the binding directive behind KEV remediation applies to federal civilian agencies only. A hospital or university is not covered by it. The alerts also say CISA still wants other organizations to act on the catalog.

The alerts do not set out a due date for any listed vulnerability. They also give no deadline formula for organizations outside the federal government. Any due date a non-federal organization uses will therefore be its own decision, made with the criteria CISA describes.

Who is bound

CISA's alerts name the directive. Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

The alerts then state the limit in plain terms. CISA's wording is that BOD 26-04 applies only to FCEB agencies.

So the obligation sits with federal civilian agencies. Appearing in the KEV Catalog does not, by itself, create a legal requirement for a private hospital or a university, according to these alerts. What it creates is a signal and an encouragement from CISA.

What the directive asks of agencies

The alerts summarize the directive in three parts, and the parts show what CISA treats as highest risk.

First, the directive requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities.

Second, the alerts define "high-risk" narrowly. They point to CVEs listed in CISA's KEV Catalog, on publicly exposed assets, that grant total control of the asset after exploitation. The directive also defers action on lower-risk vulnerabilities.

Third, the directive covers a question beyond patching. CISA says BOD 26-04 sets basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

This is the part a non-federal policy can easily leave out. A due date addresses when a patch goes on. The compromise check addresses what may have happened before it did. The alerts do not say what the expectations for that check are, so the alerts alone do not give enough to copy them.

What the three alerts list

The alerts show the kind of entries the catalog receives. Each says CISA added the vulnerabilities based on evidence of active exploitation.

On November 3, 2026, CISA listed one vulnerability, a WordPress Core flaw.

On October 30, 2026, CISA listed two Ivanti Connect Secure vulnerabilities. One is a missing authentication flaw. The other involves predictable numbers or identifiers.

On October 28, 2026, CISA listed two more. One is a Broadcom VMware ESX flaw. The other is a Linux kernel flaw.

CISA's stated reason for acting is the same in all three alerts. It says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The risk statement is framed around the federal enterprise, which fits the directive's scope. The alerts do not say which, if any, of these products a hospital or university runs.

How a non-federal organization can decide

The documents give no step-by-step method for non-federal organizations. They give one encouragement and a set of criteria. A decision about adopting the due dates can be built from those and nothing more.

The encouragement is that CISA wants all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities. That is a request to treat KEV listings as a priority input. It is not a request to copy the federal schedule.

The criteria are the ones CISA says the directive uses. An organization weighing a policy can compare its own systems against them, using the three questions CISA's description raises:

• Is the vulnerability listed in the KEV Catalog?
• Is the affected asset publicly exposed?
• Does exploitation grant total control of the asset?

The directive's approach, as CISA describes it, is to move fast on vulnerabilities that meet these conditions and to defer action on lower-risk ones. An organization that adopts the same approach would be writing its own version of that rule. The alerts do not say how fast "rapid" is, and they do not supply a number of days.

A policy could also address the compromise check. CISA describes the federal expectation as checking whether threat actors compromised the system before the patch was applied. Whether to include an equivalent step is a choice the alerts leave open.

The catalog's own limits matter too. CISA says it will keep adding vulnerabilities that meet its criteria. The list will grow, so a policy tied to the catalog will keep receiving new entries.

Feeding information back to CISA

The alerts also describe a way for organizations to contribute. Anyone aware of an exploited vulnerability that is not in the catalog can submit it.

CISA sets a threshold for what it will consider.

That threshold also explains what a KEV entry represents. By CISA's own rule, an entry has a CVE ID, evidence of exploitation and clear mitigation guidance. A security leader reading the catalog can therefore expect each listing to meet those three conditions.

Summary for a policy discussion

On the documents provided, the position is as follows. CISA says BOD 26-04 applies only to FCEB agencies, so federal civilian agencies are the ones bound. CISA encourages all organizations, including hospitals and universities, to adopt risk-based vulnerability management and to prioritize KEV Catalog vulnerabilities. The alerts describe the directive's focus: KEV-listed CVEs, publicly exposed assets, total control after exploitation, deferral of lower-risk items and a check for earlier compromise. They do not include due dates, so any deadline a non-federal organization sets is its own policy choice.