CISA gave federal agencies three days to patch Cisco Secure Firewall Management Center on 29 July, after adding a hard-coded password flaw in the console to its Known Exploited Vulnerabilities catalogue1. CISA, the US Cybersecurity and Infrastructure Security Agency, maintains that catalogue as the list of flaws it has confirmed under active attack. The dates attached to each entry bind federal civilian agencies, and vulnerability-management teams across the private sector inherit them through the scanning products that read the feed, without being bound by the directive at all.
That three-day window is no longer the exception. Of the 39 entries added between 10 June and 29 July, 34 carry a remediation deadline of three days or less, 87 per cent; of the 31 entries added between 1 May and 10 June, 12 did, 39 per cent2. Every entry carrying both a dateAdded and a dueDate was counted, the gap measured in days, and the same arithmetic applied on both sides of 10 June, with entries lacking a dueDate excluded throughout. The median window fell from 14 days to three and the mean from 9.45 days to 4.41. The published range did not move, since both directives allow the same 3-to-14 spread, but the fortnight end of it has emptied: 58 per cent of the earlier entries allowed a fortnight or more, against 13 per cent of the later ones.
BOD 26-04 took effect on 10 June, replacing the fixed clocks of its predecessor with risk-tiered triage that assigns a window per entry rather than per class, and a security chief who read "risk-based" as room to breathe has been reading it backwards. Additions did not slow to match: entries reached the catalogue at roughly 0.78 per day on either side of the changeover, so what moved is the clock attached to a flaw, not the number of flaws attracting one3. Bishop Fox's chained Ubiquiti UniFi OS Server flaws drew the same short window on 23 June, which read as an outlier at the time.
Seven weeks of register data cannot settle two confounds. If the newer entries skew towards edge appliances and management consoles, that class drew short clocks under the old regime as well, and composition alone could produce the whole drop; the catalogue has also gone quiet since 29 July, which reads equally as a summer lull in confirmed exploitation or as triage holding listings back. Both readings sat open when this beat first raised the doctrine-versus-composition question on 4 July, and only a monthly recount will close them.
