About FixBy

What FixBy is

FixBy shows the remediation timelines that the decision table in CISA’s BOD 26-04 gives a vulnerability.

Enter one CVE ID, or paste a list from a scanner (500 at a time). For each CVE, FixBy shows two timelines, one for a publicly exposed asset and one for an internal asset, because the right one depends on your asset and only you know which it is. Where the timeline is a number of days, FixBy shows the fix-by date, or a range of dates.

FixBy also flags CVEs that are not in KEV but meet its early-warning thresholds for EPSS or LEV. This early warning is FixBy’s own signal. It never changes the timeline.

FixBy is a personal project by Akimitsu Kawachi (LinkedIn). It is not affiliated with, or endorsed by, CISA, FIRST, NIST, MITRE, CERT/CC or Akimitsu Kawachi’s employer. Corrections and feedback are welcome on LinkedIn.

CISA BOD 26-04 and SSVC

CISA’s Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk”, sets how fast US Federal Civilian Executive Branch (FCEB) agencies must remediate or mitigate a vulnerability. It was issued on 10 Jun 2026, and agencies must follow its timelines within 180 days of issuance (by 7 Dec 2026). That date is when the rules start; each vulnerability then has its own deadline, from Table 1.

The directive applies directly to FCEB agencies. Other organizations may use it as a reference, subject to their own regulatory and contractual requirements: for example, FedRAMP requires certified cloud services to follow rules aligned with it, and a federal contract may require it.

Instead of one severity score, the directive’s Table 1 (Remediation Timelines) decides from four facts. The approach follows SSVC (Stakeholder-Specific Vulnerability Categorization), created by CERT/CC.

The four inputs

In CISA KEV

Whether the CVE is in CISA’s Known Exploited Vulnerabilities catalog, which lists CVEs with evidence of exploitation in the wild. FixBy reads it from CISA’s KEV feed. A CVE missing from KEV is not proof that nobody exploits it.

Automatable

“Is an adversary able to automate all the steps necessary to exploit the vulnerability?” Yes or no. Published by CISA through its Vulnrichment program.

Technical impact

Partial: limited control over, or information exposure about, the behavior of the software, or only a low, chance-based opportunity for total control. Total: total control over the behavior of the software, or total disclosure of all information on the system that contains the vulnerability. Also published by CISA through Vulnrichment.

Publicly exposed asset

CISA’s term for an asset “accessible to unauthenticated or untrusted entities via public networks”, such as the internet, “regardless of its physical or logical location”. Any other asset is internal. FixBy can’t know this one, so it always shows both.

Table 1 (Remediation Timelines)

Timelines are in calendar days. They are “dynamic as facts change”: if CISA adds a CVE to KEV or publishes new values, its timeline can change.

3 days & forensic triage

Remediate or mitigate within 3 days, and carry out a forensic triage of the asset “to assess whether the system is compromised”. A patch closes the hole; it does not remove an attacker who is already in. CISA’s implementation guidance describes the triage steps.

Fix on system upgrade

No deadline in days: remediate at the next scheduled major upgrade or rebuild of the system.

When CISA has not assessed a CVE

CISA publishes Automatable and Technical impact for many CVEs, but not all. For a CVE that is not in KEV and has no CISA values, CISA’s implementation guidance says it “will treat its values as ‘no’ and ‘total,’ respectively, until CISA or a third party provides metadata about the CVE ID”. FixBy does the same and marks the result CISA default.

FixBy also reads the CVE’s CVSS vector. When that reading differs from CISA’s default, the CVE page mentions it as a hint. It never changes the timeline.

CISA says it always provides these values for KEV entries. If a new KEV entry does not have them yet, FixBy shows Not enough data and the range of possible timelines, shorter one first.

When the clock starts

The clock starts on the earlier of two dates: the day the vulnerability is identified on an asset, and the day CISA added it to KEV. FixBy can’t know when you found it, so:

• a CVE in KEV counts from its KEV date. Its fix-by date may already have passed, and is then marked past due. For CVEs added to KEV before the timelines took effect, the directive doesn’t say; FixBy still counts from the KEV date, the stricter reading;
• any other CVE counts from today (“by Sat 31 Oct if found today”);
• “Fix on system upgrade” has no date.

So a date shown assumes you did not identify the vulnerability earlier. If you did, your deadline is earlier. Opening a CVE on FixBy does not restart the clock.

From CISA: BOD 26-04 · Implementation guidance · KEV catalog · Vulnrichment

Early warning

KEV lists CVEs once CISA has evidence that they are being exploited. The early warning flags CVEs that are not in KEV but score high on one of two estimates:

EPSS (Exploit Prediction Scoring System)

The probability that the CVE will be exploited in the wild in the next 30 days. FIRST publishes a score for nearly every published CVE each day.

LEV (Likely Exploited Vulnerabilities)

An estimated lower bound on the probability that exploitation of the CVE has already been observed, calculated daily by FixBy from the EPSS history available, using the method proposed in NIST CSWP 41. NIST notes that its margin of error is not yet known. The numbers are FixBy’s, not NIST’s.

FixBy flags a CVE that is not in KEV when its EPSS is 10% or more, or its LEV is 50% or more. These thresholds are FixBy’s choice. FIRST notes that 10% is commonly used but carries no special authority, and that the right threshold depends on how much you can remediate.

The flag shows the timeline if the CVE were added to KEV and its other inputs stayed the same. That timeline is counted from the earlier of the day the vulnerability was identified on your asset and the day CISA adds it to KEV: if you have already found it, the clock started then, and the time left may be short, or gone, when CISA adds it. CISA’s own assessment, which it provides for every KEV entry, could change the result. Planning the fix now saves time then.

The early warning is not part of BOD 26-04 and never changes the timeline. It does not confirm exploitation, and it does not predict that CISA will add the CVE to KEV. EPSS reflects exploitation activity seen by FIRST’s data partners and knows nothing about your systems. Neither EPSS nor LEV measures how severe a flaw is.

More: EPSS at FIRST · NIST CSWP 41 (LEV)

Data and how fresh it is

FixBy normally updates once a day, after FIRST publishes the day’s EPSS scores (about 13:30 UTC). Every result shows the date of the data it uses (“Data as of …”).

Updates go through automated checks. When a check fails, FixBy keeps the data it accepted before. These checks cannot catch every error. A source that falls behind can be older than that date. For KEV the page says so: if the KEV catalog could not be read for more than two days, results not in KEV say that a recent KEV addition may be missing.

Privacy

• No accounts, cookies, analytics or ads, and FixBy saves nothing in your browser’s site storage.
• Like any website, your browser keeps its own history and cache: the CVE pages you open appear in your browsing history, and the data files it downloaded may stay in its cache. To support Back and Forward, FixBy also keeps a pasted CVE list in the tab’s history, and your browser may keep it when it restores a session. Use a private window if you don’t want that.
• CVE IDs are matched in your browser. To show a CVE’s page, the browser downloads that CVE’s data file from this site, as any web page loads its files. FixBy does not keep logs of these requests.
• The page loads nothing from other sites: every file comes from this site, and its security policy blocks anything else.
• The site is hosted on Amazon Web Services (Amazon CloudFront), which handles the connection.

Terms and notices

Guidance, not an instruction. FixBy applies CISA’s published table to published data. It does not decide what you must do: that depends on your organization, your asset and when the vulnerability was found on it. FCEB agencies should follow the directive and CISA’s guidance directly.

No warranty. FixBy is provided as is, for informational purposes only. Its sources can be late or wrong, and so can FixBy. Before acting, check the vendor’s advisory and CISA’s own pages.

Notices

• CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Used under the CVE Program Terms of Use:

  CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.

  FixBy’s CVE data files carry the same notice: NOTICE.txt.
• NVD: This product uses data from the NVD API but is not endorsed or certified by the NVD.
• EPSS: EPSS scores are published by FIRST (first.org/epss), generated by Empirical Security.
• CISA: KEV and Vulnrichment data are published by CISA under CC0 1.0 (KEV licence, Vulnrichment licence). Use of CISA data does not imply endorsement by CISA or DHS.
• LEV: calculated by FixBy with the method in NIST CSWP 41; not published by NIST.
• BOD 26-04 decision table: from CERTCC/SSVC. Copyright 2026 Carnegie Mellon University. Used under its MIT (SEI)-style licence; the full licence is served next to the table file.
• Software: FixBy’s page includes hyparquet and fzstd, both under the MIT License: third-party licences.