Your patch policy quotes C I S A’s twenty-one day deadline for known-exploited vulnerabilities. Forty vulnerabilities have gone into the catalog since June tenth. Thirty-five of them gave you three days. Not one gave you twenty-one.

Somebody wrote that twenty-one into a document. Maybe it was you. It is in patch policies, in managed-service agreements, in the remediation-window column of a hundred vendor comparison sheets, and in the security page of nearly every M S P website I have ever read. It got there honestly — it was C I S A’s number, it was free, and it was defensible to a client who asked why that long.

It is still all over the catalog. One thousand and twenty-five of the 1,657 entries in the file this morning carry a twenty-one-day remediation deadline. Scroll the thing casually and twenty-one is what you see.

Every one of those is old. Here is the count that matters.

Thirty-five of the forty were given three days. The other five were given fourteen. I counted these this morning out of the catalog’s own JSON feed, by subtracting each entry’s dateAdded from its dueDate — not out of anybody’s summary.

Nobody hid this. B O D 26-04 was published on June tenth and says in its own text that it “supersedes and hereby revokes” B O D 22-01, the 2021 directive that built the K E V catalog and set the twenty-one-day rule. It replaced a single deadline with a sliding one, keyed to whether the asset is publicly exposed, whether an attacker can automate the exploit, and how much control they get.

What nobody did was go back and update the copies. The directive changed a federal deadline. The number lives in a thousand private documents that no directive touches.

And this week the two collided on a tool a lot of you actually run.

Read the version string at the end twice. I did.

N-able’s own release note says the fix is build 2026.3.1.7 and that the issue affects “all N-central instances not running 2026.3.1.” The N V D text says “through 2026.3.1.” Those two are describing the same boundary from opposite sides, and if you are self-hosted you should be reading the four-part build number, not the three-part one. Hosted instances get upgraded for you on N-able’s schedule.

There is also a detection list, which tells you something about how this was found.

Now the wider thing, which is the reason I wrote this instead of a patch notice.

If your service agreement promises a client remediation “within C I S A’s published K E V deadline,” you have quietly agreed to something much harder than you did in May. Thirty-five of the last forty entries wanted action inside seventy-two hours. That is not a patch window. That is a person being available on a Saturday.

And if your agreement instead names a flat twenty-one days, you are now slower than the federal benchmark you copied it from, in writing, in a document a client can read. I would rather find that out from me than from a client’s auditor.

Kept honest. B O D 26-04 binds federal civilian executive branch agencies. It does not bind you. Nothing here says a private company is legally required to patch in three days; the directive’s own scope section says it does not apply to contractors unless their contract says so. The reason it matters anyway is that the industry borrowed the number voluntarily, and the lender changed it. Three days is not automatic. The timeline comes from a table keyed to asset exposure, exploit automation and technical impact — five of the last forty entries still got fourteen days, and the guidance says a C V E with no available metadata is treated as sixty. I could not quote that table to you: on C I S A’s page it is published as an image, not as text, so I am describing the variables it uses rather than reproducing its rows. My counts are of the catalog, not of the world. 1,025 and 40 and 0 are what the August 3 JSON contained when I read it this morning; C I S A adds entries most weekdays and the denominators move. The 181-day entries in the file — there are 257 of them — are the original 2021 bulk load and are not evidence of anything current. I have not verified exploitation of any specific N-central instance, including yours. I am reporting that C I S A placed it in a catalog whose sole admission criterion is evidence of active exploitation, and that the vendor published indicators of compromise. Finally: I am not telling you to rewrite your S L A this afternoon. I am telling you to go and read what it currently says, which most people have not done since they wrote it.

Sources, all primary, all fetched this morning, August 4, 2026. (1) C I S A, Known Exploited Vulnerabilities Catalog, JSON feed — catalogVersion 2026.08.03, dateReleased 2026-08-03T18:55:09Z, count 1,657. Every number in this edition was computed directly from that file by differencing each entry’s dateAdded and dueDate: 1,025 entries at a 21-day interval; 254 at 14 days; 257 at 181–184 days (the November 2021 initial load); and, for the 40 entries added on or after June 10, 2026, a distribution of 35 at three days and 5 at fourteen days, with none at twenty-one. The C V E-2026-18577 record — dateAdded 2026-08-03, dueDate 2026-08-06, and the vulnerability name “N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability” — was read from the same file. (2) C I S A Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, dated June 10, 2026, fetched with a browser user-agent. Source of the quoted phrase that the directive “supersedes and hereby revokes” B O D 19-02 (April 29, 2019) and B O D 22-01 (November 3, 2021); of the four variables that set the remediation timeline (asset exposure, K E V status, exploit automation, technical impact); and of the scope language on contractors. Table 1: Remediation Timelines is published on that page as an image and is therefore described, not quoted. The sixty-day default for a C V E lacking metadata is quoted from the companion Implementation Guidance. (3) N V D record for C V E-2026-18577, published 2026-08-02T23:16:26, last modified 2026-08-04T13:06:59 — source of the description quoted in full above, of the C V S S 4.0 base score 8.2 / High, and of the exploit-maturity value E:A (Attacked) in the vector string. It also independently carries cisaExploitAdd 2026-08-03 and cisaActionDue 2026-08-06. (4) N-able, “N-central 2026.3 Hotfix 1 — Mitigation for CVE-2026-18577,” posted August 2, 2026 — the vendor’s own release note, source of build 2026.3.1.7, of the statement that 2026.3.0 “was release on ‘July 30th 2026’”, of the affected-population phrase “all N-central instances not running 2026.3.1,” of the indicators of compromise quoted above, and of the hosted-versus-self-hosted upgrade split. No security trade press supplied any fact in this edition.

There is a number in your patch policy that stopped being true on June 10, and nobody sent a memo.

Twenty-one days. CISA's remediation deadline for known-exploited vulnerabilities. It's in managed-service agreements, vendor comparison sheets, and the security page of nearly every MSP site I've read. It got there honestly — it was CISA's number, it was free, and it was defensible to a client who asked why that long.

I pulled the KEV catalog's JSON this morning and counted.

1,657 entries. 1,025 of them carry a 21-day deadline. That's 62% of the file, which is why the number still feels current when you scroll it.

Every one of those is old.

Entries added since June 10, when BOD 26-04 took effect: 40.
Of those 40, given 21 days: zero.
Given three days: 35.

BOD 26-04 says in its own text that it "supersedes and hereby revokes" BOD 22-01 — the 2021 directive that built the catalog and set the 21-day rule. One deadline became a sliding one, keyed to whether the asset is publicly exposed, whether the exploit can be automated, and how much control it hands over.

The directive changed a federal deadline. It did not change the thousand private documents that copied it.

And yesterday the two collided on a tool a lot of us run.

CVE-2026-18577. N-able N-central. Added August 3. Due August 6. Three days.

Here is NVD's entire description of it:

"An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1"

Incomplete patch. N-able shipped 2026.3.0 on July 30 and hotfix 2026.3.1 three days later. If you patched last week and closed the ticket, you are sitting on the version that didn't hold.

N-central is the console you reach every managed endpoint from. An authentication bypass there isn't one box. It's the thing with an agent on all the others.

And N-able published indicators of compromise, which vendors do when the question has stopped being whether it could be exploited:

"review devices users's documents folder for a file called ''svchost.exe'', as well as look for a registered service name called 'Cloudflared'" — plus four inbound IPs for your firewall logs.

So: check your build number, get to 2026.3.1, then run the IOC checks. Upgrading closes the door. It tells you nothing about whether someone already walked through it.

The wider point, and the reason I didn't just post a patch notice:

If your agreement promises remediation "within CISA's published KEV deadline," you agreed to something much harder in June than you did in May. Thirty-five of the last forty wanted action inside 72 hours. That isn't a patch window, it's someone being reachable on a Saturday.

And if your agreement names a flat 21 days, you are now slower than the benchmark you copied — in writing, in a document your client can read.

Better to hear that from me than from their auditor.

Kept honest: BOD 26-04 binds federal civilian agencies, not you. Its own scope section excludes contractors unless the contract says otherwise. Nothing here makes three days a legal duty for a private company. It matters because the industry borrowed the number voluntarily and the lender changed it. Three days also isn't automatic — five of the last forty still got fourteen, and a CVE with no metadata is treated as sixty. I couldn't quote CISA's timeline table because it's published as an image, so I described its variables instead. My counts are of the August 3 JSON as I read it this morning; the denominators move. And I have not verified exploitation of any specific N-central instance, including yours.

FIRST SOURCE · one verified original-source finding, composed for one reader · this edition: cybersecurity — written for the people whose clients read the remediation window before they read anything else