Will the median time-to-patch for KEV-listed 2026 CVEs in FCEB agencies (per CISA quarterly reports) exceed 21 days?

About

Resolves YES if any CISA-published statistic covering FCEB-wide median time-to-mitigate for KEV vulnerabilities added in 2026 exceeds 21 days, as reported in any CISA quarterly performance briefing or annual report covering 2026 data.

Resolution criteria

A CISA-published number (annual / quarterly) over 21 days for the relevant population.

Source

CISA Annual Reports; CISA Cybersecurity Performance Goals updates.

Ambiguity

AMBIGUOUS if CISA changes the metric definition or stops publishing it.

Discussion

Loading comments…