How Old Were the CVEs CISA Added to KEV in Sep and Oct 2026?

CISA added 61 CVEs to the Known Exploited Vulnerabilities catalog between 1 September and 16 October 2026. We matched each one to its official CVE record and measured the gap between the CVE's publication date and the day it entered KEV. The median gap was three days.

The spread is what matters. More than half arrived within a week of disclosure, but six were older than a year, including three from 2015 and 2016.

How we counted

Two public datasets: the KEV JSON feed (catalog version 2026.10.16, downloaded 18 October 2026) and the CVE Services API run by the CVE Program, which returns the authoritative datePublished for each record.

curl -sS -o kev.json \
  https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

python3 -I -c '
import json
for v in json.load(open("kev.json"))["vulnerabilities"]:
    if "2026-09-01" <= v["dateAdded"] <= "2026-10-16":
        print(v["cveID"])
' > ids.txt

for c in $(cat ids.txt); do
  curl -sS -o "cve_$c.json" "https://cveawg.mitre.org/api/cve/$c"
done

import json, collections, datetime as dt

d = json.load(open("kev.json"))
w = [v for v in d["vulnerabilities"]
     if "2026-09-01" <= v["dateAdded"] <= "2026-10-16"]

def bucket(days):
    if days < 0:   return "added before CVE publish date"
    if days == 0:  return "same day"
    if days <= 7:  return "1 to 7 days"
    if days <= 30: return "8 to 30 days"
    if days <= 365: return "31 to 365 days"
    return "more than a year"

ages, states = [], collections.Counter()
for v in w:
    rec = json.load(open(f"cve_{v['cveID']}.json"))["cveMetadata"]
    states[rec["state"]] += 1
    pub = dt.date.fromisoformat(rec["datePublished"][:10])
    ages.append((dt.date.fromisoformat(v["dateAdded"]) - pub).days)

print(states)
print(collections.Counter(bucket(a) for a in ages))
ages.sort()
print("median", ages[len(ages) // 2], "max", ages[-1])

One caveat on precision. KEV's dateAdded is a calendar date with no time zone, while datePublished is a UTC timestamp. A one-day difference either way can come from time zones alone.

What's affected

The two "negative" entries are Acronis Backup (CVE-2026-87886) and GitLab (CVE-2026-85706). In both, the CVE record's UTC publish date is one day after KEV's date, which fits the time zone caveat above.

The 17 same-day additions were mostly edge and enterprise products: three NetScaler CVEs, two Cisco Secure Email Gateway CVEs, PAN-OS, Ivanti Connect Secure, FortiMail, F5 BIG-IP APM, Check Point, Arista VeloCloud, Cisco ISE, Catalyst SD-WAN Manager, three Windows CVEs and a Chromium V8 CVE.

The oldest six, in days from publication to KEV:

Five of the six were added on the same day, 8 October.

One more finding. CVE-2026-21589, an Atlassian Data Center file access bug added to KEV on 15 October, shows state: REJECTED in its CVE record. The CNA rejected it on 16 October at 20:39 UTC with the reason "This CVE's publication may have been a false positive or a mistake." It was still in KEV catalog version 2026.10.16 when we downloaded it.

How to check if you're exposed

The long tail is the part most teams miss. Old CVEs usually live in old software: appliances that were never upgraded, base images pinned years ago, vendored copies of libraries.

# Old packages in a Debian or Ubuntu image
docker run --rm your-image:tag dpkg -l | grep -iE "proftpd|bind9"

# Apache Struts in Java builds
grep -rn "struts2-core" --include=pom.xml --include=*.gradle .

# Strapi in Node projects
grep -rn '"strapi"\|"@strapi/strapi"' --include=package.json .

For appliances and servers, ask a narrower question: which systems run a version released before the fix for each of these six CVEs? Your asset inventory should answer that without a scan.

What to do now

1. Patch on the vendor advisory, not on KEV. 34 of 61 entries were added to KEV within a week of publication, counting the two time zone cases. If you wait for KEV, you start late on the ones that move fastest.
2. Run a yearly sweep for old CVEs. Pick software that is EOL or unpatched for more than a year and check it against the full KEV list, not just new additions.
3. Check BIND and ProFTPD specifically. Both are infrastructure services that often run on hosts no one has touched in years.
4. Watch for rejected CVEs. If CVE-2026-21589 is in your tracker, follow Atlassian's advisory directly and don't close the ticket on the rejection alone.
5. Store the CVE publish date in your tracker. It lets you measure your own time to patch against the same baseline.

Why it matters

KEV gets read as a list of new threats, and most of it is. But 20 of these 61 entries were more than 30 days old when they were added, and six were older than a year. Exploitation evidence often shows up long after disclosure.

The practical lesson is to run two loops. A fast loop acts on vendor advisories within days. A slow loop checks the whole estate against the full catalog on a schedule, because a 2015 CVE can join KEV in 2026.

Try it yourself

Take the six oldest CVEs from the table and search your SBOMs and asset list for the affected products. Note how long each search takes. If a search is slow, that product is missing from your inventory. The demo below shows how a fix-available view surfaces patched versions for known CVEs.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog, JSON feed
• CVE Services API record for CVE-2026-21589
• CVE Services API record for CVE-2015-3306