12OCT

CISA set three-day deadlines on 34 flaws

2 min read

10:55UTC

CISA gave federal agencies three days to fix 34 of the 43 exploited flaws it listed in September, up from 71 per cent of listings in August.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Seventy-nine per cent of September's exploited-flaw listings gave federal agencies three days to patch.

The Cybersecurity and Infrastructure Security Agency (CISA) put 43 flaws on the Known Exploited Vulnerabilities (KEV) list in September, and 34 of them, 79 per cent, carried a three-day remediation deadline⁠¹. The other nine got 14 days. KEV is CISA's list of bugs confirmed as used by attackers, and the deadlines bind US federal civilian agencies; companies and insurers use the same list to decide what to fix first. The three-day share rose from 71 per cent in August.

A three-day deadline means testing and pushing a fix within three days of the listing, outside the monthly change window most IT Teams run on. The median stayed at three days under the risk-tiered directive that replaced fixed deadlines in June. October's first nine entries all carried three days, but most of them came from the single China advisory, so they say little about a trend.

MikroTik, the Latvian maker of the RouterOS operating system that runs its routers, took three of the September entries between 10 and 25 September⁠². They were its first KEV listings since 2022. Two of the three chain together into an unauthenticated takeover of the router.

Deep Analysis

In plain English

The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a public list of software flaws that criminals or spies are already using. When a flaw goes on the list, US government departments must fix it by a deadline. Since June the deadline depends on how risky the flaw is. In September most new entries got the shortest one: three days. Three of the flaws were in routers made by MikroTik, a Latvian company whose cheap, powerful routers are common in small offices and with internet providers. Two of those flaws can be combined so that a stranger on the internet can take over the router.

Deep Analysis

Root Causes

MikroTik RouterOS runs on huge numbers of small-business and internet-provider edge routers, many never updated after installation. That long tail makes any new RouterOS flaw useful to botnet builders and to state proxy networks.

The September pair chains because one flaw (CVE-2026-86060) lets a user change the RouterOS policy mask that decides what they may do, while the other (CVE-2026-67279) lets an unauthenticated client open a session in the first place. Alone, the first needs a login; together they need none.

KEV listings depend on exploitation evidence reaching CISA, so vendors with large incident-response customer bases feed the catalogue faster than vendors whose devices sit unmonitored.

What could happen next?

Risk
Unpatched MikroTik routers are likely to be pulled into botnets and proxy networks, as the 2018 Winbox flaw was.
Meaning
With 34 of 43 September entries on the shortest tier, BOD 26-04's middle and long windows are being used mainly for browsers and operating systems.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In 2021 the Mēris botnet ran record denial-of-service attacks, including against Yandex, from roughly 250,000 MikroTik routers. Most had been compromised through Winbox flaw CVE-2018-14847, patched three years earlier, because credentials stolen before patching kept working.

Counter-parallel: CISA's BOD 19-02 in April 2019 set a 15-day window for critical internet-facing flaws, keyed to severity scores rather than evidence of attack. CISA dropped severity-led deadlines in 2021 because most critical-scored flaws were never exploited, the reasoning that still underpins exploitation-based listing.

A three-day clock forces patching outside the normal monthly change cycle, which means overtime, emergency change boards and accepted risk of breaking production. Each extra three-day listing carries that cost again for every agency that runs the product.

For MikroTik owners the cost is mostly labour: RouterOS updates are free, but many routers sit in branch sites or customer premises with no local IT staff.

Consensus view: CISA's risk tiering under BOD 26-04 scores each entry on exploitation, exposure and impact, and edge and management appliances keep landing in the shortest tier. September's mix sits below the 87 per cent seen between 10 June and 29 July, so the directive is not drifting steadily towards longer windows.

Counter-view: ENISA's Cyber Resilience Act reporting platform puts the clock on the manufacturer instead, requiring a report within 24 hours of a maker learning its product is actively exploited. The EU model loads the urgency onto the vendor; the US model loads it onto every agency running the product.

Key tension: Whether a deadline carried by nearly four in five entries still tells a patch team what is urgent, or has become the default that tells it nothing.

Sources:CISA·MikroTik

Mentions:CISA →Known Exploited Vulnerabilities →MikroTik →BOD 26-04 →China →Cyber Resilience Act →ENISA →Yandex →United States →RouterOS →BOD 19-02 →Mēris botnet →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

The risk-tiered directive issued in June sets the deadline mix measured for September.

Occurred 10 Jun 2026

Read story →

KEV three-day deadline share fell to 71%

The September deadline count follows the August three-day share.

Occurred 2 Sept 2026

Read story →

This Event

CISA set three-day deadlines on 34 flaws

Most newly exploited flaws now demand an emergency patch outside the normal monthly change cycle.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.