CISA Cut the Patch Window to Three Days, and 361 Breached Networks Explain Why

Three hundred and sixty one organisations across 47 countries were breached within five days of a VMware vCenter patch going out. China-nexus attackers did not need to find the flaw themselves. The patch told them where it was.

That is the context for the new CISA three day patch window, which shortens the remediation deadline for certain enterprise flaws from the previous timeline down to 72 hours.

What triggered the CISA three day patch window

The vCenter campaign is the headline number, but it is not an isolated case. GitLab CVE-2026-19478, rated CVSS 9.4, came under active exploitation within days of disclosure. It lets an unauthenticated attacker modify or delete public projects and rewrite their data, which is roughly the worst outcome available on a source control platform.

Microsoft's August Patch Tuesday shipped fixes for 421 CVEs, including one exploited zero day. A maximum severity Entra ID flaw, CVE-2026-69836, was initially flagged as exploited and then corrected to not exploited on 21 August, which is its own small lesson in how fast the picture moves during a patch cycle.

Why three days is the realistic number, not a dramatic one

Publishing a patch is publishing a map. Diffing a fix to work out what it repairs is routine work, and the gap between a vendor advisory and mass exploitation is now measured in days, sometimes hours. CISA is not being alarmist here; it is reading the same telemetry everyone else can see.

The uncomfortable part for most teams is that three days is not a patching problem. It is a change management problem. If your emergency change process requires a board that meets weekly, the window closed before you filed the ticket. We saw the same pattern in the vCenter and Babuk ransomware campaign and again with the SharePoint RCE that went from disclosure to active exploitation.

The three day checklist

• Inventory anything internet facing, and keep that inventory current rather than annual.
• Subscribe to vendor advisory feeds directly, not the news cycle. The news is a day behind the exploit.
• Get a pre-approved emergency change path signed off now, while nothing is on fire.
• Assume public patch equals public exploit, and plan the maintenance window on that basis.

Operational technology teams have the hardest version of this, because you cannot always reboot the thing. Our primer on what a PLC is and why it matters for security covers why those environments patch on a different clock entirely.

What to watch next is whether the three day deadline holds when it collides with a patch that breaks production. That is the test, and it will arrive sooner than anyone would like.