Which weekdays does CISA add KEV entries? Counts by day of the week

Across all 1,748 CISA KEV entries, Wednesday leads with 544, but 287 of those are the launch day, 3 November 2021. Since 1 January 2024 Tuesday leads with 205 of 695 additions (29%), and weekends are almost empty: four Sunday entries ever, none on Saturday. A once-a-day weekday check is enough to catch most additions.

Method

We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16) and converted the dateAdded field of each entry to a weekday. The field is a calendar date with no time or time zone, so we cannot say what hour an entry appears. It is the date CISA records for the addition, not a timestamp.

The all-time counts mislead

The all-time Wednesday peak is a launch effect. On 3 November 2021, a Wednesday, 287 entries went in on one day when the catalog opened. Without that day, Wednesday has 257 entries, fewer than Thursday (340) or Tuesday (334). Reading the 2024 to 2026 column instead, Tuesday is the busiest day, Friday the quietest, and Wednesday and Thursday sit in between.

How big a day can get

Since 1 October 2025, additions have landed on 153 different dates, and the largest single day had 8 entries. In the most recent thirteen months, the catalog grew by between 11 and 43 entries a month (September 2026 had 43, November 2025 had 11). That is a steady trickle, not a flood: a feed check will usually show a handful of new lines.

What the weekday pattern does not tell you

• It does not tell you when exploitation started. Attackers often use a flaw before CISA lists it.
• It does not tell you that Friday is safe. A Friday addition has the same urgency as any other.
• It does not tell you about vendor patch days. A vendor's patch release is not the same day as the KEV date.

How to use it

For a team with no dedicated analyst, three small habits cover most of the risk:

1. Check the feed once each working day, and again before the weekend.
2. Alert on additions that match a vendor or product in your inventory, rather than reading every entry.
3. Name a backup for weekends, because a rare Sunday addition still shows that entries can arrive when nobody is looking.

A script that polls the JSON feed on a schedule and filters by your vendors removes most of the manual work.

Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at how an alert fires the moment a watched item changes, without anyone checking by hand.

Quick check

Sources

• CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).

Last reviewed: 19 October 2026.