22OCT

CISA set three-day deadlines on 34 flaws

2 min read

16:31UTC

CISA gave federal agencies three days to fix 34 of the 43 exploited flaws it listed in September, up from 71 per cent of listings in August.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

Seventy-nine per cent of September's exploited-flaw listings gave federal agencies three days to patch.

The Cybersecurity and Infrastructure Security Agency (CISA) put 43 flaws on the Known Exploited Vulnerabilities (KEV) list in September, and 34 of them, 79 per cent, carried a three-day remediation deadline⁠¹. The other nine got 14 days. KEV is CISA's list of bugs confirmed as used by attackers, and the deadlines bind US federal civilian agencies; companies and insurers use the same list to decide what to fix first. The three-day share rose from 71 per cent in August.

A three-day deadline means testing and pushing a fix within three days of the listing, outside the monthly change window most IT Teams run on. The median stayed at three days under the risk-tiered directive that replaced fixed deadlines in June. October's first nine entries all carried three days, but most of them came from the single China advisory, so they say little about a trend.

MikroTik, the Latvian maker of the RouterOS operating system that runs its routers, took three of the September entries between 10 and 25 September⁠². They were its first KEV listings since 2022. Two of the three chain together into an unauthenticated takeover of the router.

Deep Analysis

In plain English

The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a public list of software flaws that criminals or spies are already using. When a flaw goes on the list, US government departments must fix it by a deadline. Since June the deadline depends on how risky the flaw is. In September most new entries got the shortest one: three days. Three of the flaws were in routers made by MikroTik, a Latvian company whose cheap, powerful routers are common in small offices and with internet providers. Two of those flaws can be combined so that a stranger on the internet can take over the router.

Deep Analysis

Root Causes

MikroTik RouterOS runs on huge numbers of small-business and internet-provider edge routers, many never updated after installation. That long tail makes any new RouterOS flaw useful to botnet builders and to state proxy networks.

The September pair chains because one flaw (CVE-2026-86060) lets a user change the RouterOS policy mask that decides what they may do, while the other (CVE-2026-67279) lets an unauthenticated client open a session in the first place. Alone, the first needs a login; together they need none.

KEV listings depend on exploitation evidence reaching CISA, so vendors with large incident-response customer bases feed the catalogue faster than vendors whose devices sit unmonitored.

What could happen next?

Risk
Unpatched MikroTik routers are likely to be pulled into botnets and proxy networks, as the 2018 Winbox flaw was.
Meaning
With 34 of 43 September entries on the shortest tier, BOD 26-04's middle and long windows are being used mainly for browsers and operating systems.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In 2021 the Mēris botnet ran record denial-of-service attacks, including against Yandex, from roughly 250,000 MikroTik routers. Most had been compromised through Winbox flaw CVE-2018-14847, patched three years earlier, because credentials stolen before patching kept working.

Counter-parallel: CISA's BOD 19-02 in April 2019 set a 15-day window for critical internet-facing flaws, keyed to severity scores rather than evidence of attack. CISA dropped severity-led deadlines in 2021 because most critical-scored flaws were never exploited, the reasoning that still underpins exploitation-based listing.

A three-day clock forces patching outside the normal monthly change cycle, which means overtime, emergency change boards and accepted risk of breaking production. Each extra three-day listing carries that cost again for every agency that runs the product.

For MikroTik owners the cost is mostly labour: RouterOS updates are free, but many routers sit in branch sites or customer premises with no local IT staff.

Consensus view: CISA's risk tiering under BOD 26-04 scores each entry on exploitation, exposure and impact, and edge and management appliances keep landing in the shortest tier. September's mix sits below the 87 per cent seen between 10 June and 29 July, so the directive is not drifting steadily towards longer windows.

Counter-view: ENISA's Cyber Resilience Act reporting platform puts the clock on the manufacturer instead, requiring a report within 24 hours of a maker learning its product is actively exploited. The EU model loads the urgency onto the vendor; the US model loads it onto every agency running the product.

Key tension: Whether a deadline carried by nearly four in five entries still tells a patch team what is urgent, or has become the default that tells it nothing.

Sources:CISA·MikroTik

Mentions:CISA →Known Exploited Vulnerabilities →MikroTik →BOD 26-04 →China →Cyber Resilience Act →ENISA →Yandex →United States →RouterOS →BOD 19-02 →Mēris botnet →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

The risk-tiered directive issued in June sets the deadline mix measured for September.

Occurred 10 Jun 2026

Read story →

KEV three-day deadline share fell to 71%

The September deadline count follows the August three-day share.

Occurred 2 Sept 2026

Read story →

This Event

CISA set three-day deadlines on 34 flaws

Most newly exploited flaws now demand an emergency patch outside the normal monthly change cycle.

Led to

Six agencies tie SafePay to old flaws

October's three-day share of KEV additions rose above September's 34 of 43.

Occurred 20 Oct 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.