KEV Due Dates Collide With FedRAMP Flaw Remediation Timeframes

Two remediation clocks now point at the same flaws. One clock runs in days, and the other runs in weeks. Cloud service providers need to keep both clocks straight.

On October 14, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four flaws. They entered the Known Exploited Vulnerabilities (KEV) catalog that day. Reporting on the entries gives federal agencies until October 17, 2026.

The four flaws on the clock

CVE-2026-0322 hits PAN-OS firewalls and scores 8.6. An authenticated attacker can run code as root. Palo Alto Networks confirms very limited exploitation.

CVE-2026-76519 hits Cisco Secure Email Gateway and scores 9.8. The Common Vulnerability Scoring System (CVSS) calls that score critical. No login is needed to reach root here.

CVE-2026-105133 scores 5.5 in Ahsay AhsayCBS. CVE-2026-105134 scores 9.3 in the same product. Attackers chain them for SYSTEM level command execution.

Which clock applies where

Binding Operational Directive (BOD) 26-04 binds Federal Civilian Executive Branch agencies. It drives the October 17 date for agency systems. Agencies must also check for compromise before patching.

The Federal Risk and Authorization Management Program (FedRAMP) sets different timeframes. Its continuous monitoring expects critical and high flaws fixed within 30 days. Moderate flaws get 90 days, and low flaws get 180.

A provider can face both frameworks at once. An agency customer may owe the three day response. The provider may track the same flaw in a Plan of Action and Milestones (POA&M). Planning to the earlier date avoids a missed promise.

What the POA&M entry should carry

Name the appliance and its role in the service. Record the current build and the fixed build. Record the patch date and the verification step. Record the compromise check as its own line item.

That last point matters for this batch. Root access on an appliance can hide later access. A patched build alone does not prove a clean system.

PolicyCortex does not patch these appliances. Providers and their vendors apply the fixes. PolicyCortex is not FedRAMP authorized, and this article makes no such claim.

What to do this week

Sort affected systems by owner and by clock. Patch agency facing exposure on the shortest timeline. Open or update the POA&M entry the same day. Keep the compromise check open until it finishes.

Sources

• CISA alert, CISA Adds Four Known Exploited Vulnerabilities to Catalog, October 14, 2026. https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
• CISA Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CVE-2026-0322 record, CVE Program. Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0322
• CVE-2026-76519 record, CVE Program. Cisco advisory cisco-sa-esa-afw-zqYJkjxp.
• CVE-2026-105133 and CVE-2026-105134 records, CVE Program.
• FedRAMP Continuous Monitoring resources. https://www.fedramp.gov
• Original diagram by PolicyCortex.

Next step

Want POA&M evidence that updates from the live cloud, not by hand? See how PolicyCortex collects flaw remediation records.