CISA KEV and the three-day clock that a vendor has to answer

What the CISA KEV entry actually says#

The fox listens before it leaps. On 13 October 2026 the US cyber agency's alert said CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026, for Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The catalogue entry carries a due date of 16 October, three days after listing. That three-day clock is the part of a CISA KEV entry that vendors forget to write about.

The National Vulnerability Database describes the flaw in one plain sentence: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Its score is 8.6, high but not the top of the scale, which tells you something about how little the number alone can say about urgency.

Note the first stop on that line. BleepingComputer's extract points to exploitation in the wild starting October 1, but the subject of that sentence is unclear in the copy, and SecurityWeek, citing Volexity, puts it on October 3. The honest summary is early October, with the exact day unresolved. The fourth stop comes from the agency itself: Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.

Observed, researched, asserted: three kinds of sentence#

Security advisories speak in three registers, and a good reader sorts them. Observed means a government listing or a measurement anyone can check. Researched means a named third party reported something, usually without publishing the full evidence yet. Asserted means the vendor said it, in its own interest and its own words. Ivanti's own framing, as BleepingComputer relayed it, was that Ivanti is aware of limited exploitation in the wild.

Two caveats keep the table honest. First, the Ivanti advisory itself could not be opened for this piece, so every vendor sentence here is second-hand. Second, CISA's own alert flags a limit on the vendor's tooling: Ivanti's Integrity Checker Tool may not detect evidence of exploitation. A reassuring scan result is not evidence of safety.

That is the most useful sentence for a customer-facing team, because it is the one that stops a vendor from writing we have checked and found nothing. The better line is what we checked, with which tool, and what that tool cannot see.

That post is one vendor's honeypot data and should be read as such: it shows opportunistic scanning arrived within a day of the listing, which is exactly what a KEV entry tends to do. It does not tell you whether your own appliance was touched.

Why the edge keeps arriving first#

None of this is new, and that is the point. Edge devices, the VPN concentrators and gateways that sit at the boundary, are where the exploitation numbers keep landing. Mandiant's M-Trends 2026, drawn from over 500,000 hours of frontline incident investigations, reports that the mean time to exploit vulnerabilities dropped to an estimated -7 days, meaning exploitation is routinely occurring before a patch is even released.

Google's own review of 2025 zero-days gives the structural reason. It counted 43 (48%) zero-days in enterprise software and appliances in 2025, up from 36 (46%) in 2024, and warned that the absence of EDR technology on most edge devices, like routers, switches, and security appliances, can create a blind spot for defenders. The thing that is attacked most is the thing that is watched least.

• -7 days

  estimated mean time to exploit, per Mandiant M-Trends 2026

• 48%

  of 2025 zero-days hit enterprise software and appliances, up from 46%

• 31%

  of breaches began with a vulnerability, per Verizon's DBIR 2026 landing page

Verizon's landing page for the 2026 report says 31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. A secondary summary by watchTowr reports a median of 43 days to remediate a known-exploited vulnerability, which I could not check against the report's full text. Put that against a three-day KEV clock and the gap is the story.

Sensor data points the same way. GreyNoise reported that Palo Alto GlobalProtect received 16.7 million sessions, more than 3.5x Cisco and Fortinet combined, across a 162-day window in the second half of 2025. Different vendors, different boxes, same boundary. The KEV due date is the number to put on the wall, and the CISA KEV catalog is the page to watch. Hunting this problem is patient prowl work: pick up the scent at the perimeter, follow the trail of logs through the undergrowth, and keep one eye on the den, because the quarry rarely announces itself.

What a security vendor should publish in 72 hours#

The CISA KEV clock is written for federal agencies, but it sets the tempo for everyone. BOD 26-04 uses four factors to set remediation urgency, with deadlines that range from 3 to 60 days, per Covington's reading, and the precedent is a blunt one: in 2024 the agency told federal bodies to apply the updates to the products within 48 hours of Ivanti releasing the updates. A vendor's customers will measure it against that tempo, whether or not they are federal.

That checklist is also a buyer's test. Ask a supplier for the same five things, in writing, and notice which ones arrive. The same discipline informs folkfox's work with cybersecurity marketing teams, and it underpins content marketing services that have to be right the first time. For a close cousin of this story, read the Danfoss controller exposure and what an EPSS score really adds.

One last note on voice. Write it plainly and date it. Nothing damages a security brand faster than a calm sentence that the next hour's evidence contradicts.

Frequently asked questions#