← Back to Blog

CISA Slashes Patch Deadlines, White House Rewrites Cyber Strategy & March Patch Tuesday Hits 83 Flaws

CISA accelerates mandatory patching timelines for critical Ivanti and SolarWinds vulnerabilities — a move that mirrors NIS2's urgency requirements. The White House unveils a new national cyber strategy pledging to ease regulations while imposing costs on adversaries. Microsoft's March 2026 Patch Tuesday delivers 83 fixes. And Finnish intelligence warns of persistent Russian and Chinese cyber espionage targeting EU member states.

---

⚡ CISA Shortens Patch Deadlines for Critical Ivanti & SolarWinds Bugs

The Cybersecurity and Infrastructure Security Agency (CISA) has taken the unusual step of shortening its Known Exploited Vulnerabilities (KEV) catalog remediation deadlines for newly added Ivanti and SolarWinds flaws. Instead of the standard 21-day window, affected federal agencies must now patch within a compressed timeline — signaling that active exploitation is imminent or already underway.

This matters for European organizations because CISA's KEV catalog has become a de facto global standard for vulnerability prioritization. When CISA accelerates timelines, it's a leading indicator of real-world risk.

NIS2 Alignment: Why EU Entities Should Mirror CISA's Urgency

CISA Requirement	NIS2 Parallel (Art. 21)	Recommended Action
Compressed patch deadline for KEV entries	Vulnerability handling and disclosure obligations	Adopt CISA KEV timelines as internal SLA benchmarks
Mandatory remediation for federal agencies	Essential entities must implement risk management measures	Treat KEV-listed CVEs as NIS2-reportable events if exploited
Active exploitation confirmed	Incident reporting within 24 hours (Art. 23)	Pre-stage incident response for Ivanti/SolarWinds environments

---

🏛️ White House Unveils New Cyber Strategy: Easing Regulations While 'Imposing Costs'

The White House has released a new national cybersecurity strategy that marks a significant policy pivot: reducing regulatory burden on the private sector while pledging to aggressively impose costs on malicious cyber actors. The strategy explicitly calls for streamlining overlapping compliance requirements and consolidating incident reporting frameworks.

For European organizations operating in or with the United States, this creates a diverging regulatory landscape. While the EU doubles down on mandatory compliance through NIS2, DORA, and the EU AI Act, the U.S. is signaling a move toward voluntary frameworks and industry self-regulation.

Transatlantic Compliance Divergence

Area	U.S. Strategy (2026)	EU Approach (NIS2/DORA)
Incident reporting	Consolidate into single framework, reduce duplication	Mandatory 24h/72h reporting with sector-specific requirements
Compliance burden	Ease requirements, favor industry-led standards	Expanding mandatory requirements with penalties up to €10M or 2% of turnover
Enforcement approach	Carrots over sticks — incentivize security investment	Mandatory audits, supervisory oversight, personal liability for management
Offensive posture	Active 'impose costs' on adversaries	Defensive focus — resilience and incident management

GDPR Data Transfer Implications

The strategy's emphasis on information sharing between government and private sector raises fresh questions about GDPR cross-border data transfer adequacy. If U.S. government agencies gain broader access to private sector cybersecurity data, European DPAs may scrutinize whether the EU-U.S. Data Privacy Framework adequately protects personal data involved in threat intelligence sharing.

---

🔧 Microsoft March 2026 Patch Tuesday: 83 Vulnerabilities, Zero-Day Pressure

Microsoft's March 2026 Patch Tuesday addresses 83 vulnerabilities across the Windows ecosystem, with SAP also releasing critical patches for FS-QUO and NetWeaver, and Adobe fixing 80 flaws across eight products. The sheer volume creates an urgent compliance challenge for regulated entities.

Regulatory Patch Management Requirements

• NIS2 (Art. 21): Vulnerability handling is a mandatory cybersecurity risk management measure — delayed patching of known vulnerabilities constitutes non-compliance
• DORA (Art. 7): Financial entities must maintain up-to-date ICT systems — a patch backlog creates an auditable gap in ICT risk management
• GDPR (Art. 32): Appropriate technical measures include keeping systems patched — a breach via a known, unpatched vulnerability significantly increases liability
• EU AI Act: AI systems running on unpatched infrastructure fail the robustness requirements of Article 15

SAP & Adobe: Don't Forget the Rest

SAP's critical patches address a code injection bug in FS-QUO and an insecure deserialization flaw in NetWeaver — both could lead to arbitrary code execution. For financial institutions running SAP, these patches are DORA-critical.

Adobe's 80 fixes span Commerce, Illustrator, Acrobat Reader, and Premiere Pro. Acrobat Reader vulnerabilities are particularly concerning for organizations processing regulated documents — a compromised PDF reader could expose GDPR-protected data.

---

🕵️ Finnish Intelligence Warns: Persistent Russia & China Cyber Espionage Targeting EU

Finland's intelligence service (Suojelupoliisi) has issued a formal warning about persistent cyber espionage campaigns from Russia and China targeting Finnish and broader European infrastructure. This follows the Dutch AIVD's warning about Russian messaging account hijacking reported yesterday.

The pattern is clear: state-sponsored actors are systematically targeting EU member states, and the intelligence community is increasingly going public with warnings — a sign that the threat level has escalated beyond quiet diplomatic channels.

NIS2 Incident Reporting: When Espionage Becomes Compliance

Scenario	NIS2 Reporting Obligation	Timeline
Suspected APT compromise of network infrastructure	Early warning to national CSIRT	Within 24 hours of detection
Confirmed data exfiltration by state actor	Full incident notification + GDPR breach report	72 hours (NIS2 & GDPR)
Espionage implant found on critical infrastructure	Significant incident report with root cause analysis	Final report within 1 month

Recommended Defensive Measures

• Network segmentation: Isolate critical systems from general-purpose networks to limit lateral movement
• Enhanced logging: Enable detailed logging on all internet-facing systems and review for indicators of compromise (IoCs) from ENISA and national CSIRTs
• Threat intelligence feeds: Subscribe to CERT-FI, CERT-NL, and BSI advisories for APT-specific indicators
• Employee awareness: Brief staff on social engineering tactics used by Russian and Chinese APT groups — spear-phishing remains the primary initial access vector
• Encrypted communications audit: Following the Dutch warning about Signal/WhatsApp hijacking, verify all linked devices on encrypted messaging platforms

---

🔥 FortiGate Credential Theft Campaign: Supply Chain Risk Under DORA

SentinelOne has uncovered a campaign targeting FortiGate Next-Generation Firewalls to extract configuration files containing service account credentials linked to Active Directory and LDAP. The campaign specifically targets healthcare, government, and managed service providers.

This is a textbook supply chain compromise scenario under both NIS2 and DORA frameworks. Network security appliances — devices deployed specifically to protect environments — are being weaponized to undermine the very infrastructure they guard.

DORA Supply Chain Implications

• DORA Article 28 (Third-party risk): Financial entities using FortiGate firewalls must assess whether their managed security provider has been compromised
• DORA Article 11 (Response and recovery): Credential theft from network appliances may require full AD credential rotation — a significant operational disruption that must be planned for
• NIS2 Article 21(2)(d): Supply chain security explicitly includes security of network and information systems — a compromised firewall is a direct supply chain failure

---