CERT-In's September Alerts: Edge Devices Under Fire and the 12-Hour Patch Window
CERT-In published 20 vulnerability notes in nine days. Several covered critical or actively exploited flaws in internet-facing gateways and firewalls. That is the scenario CERT-In's 12-hour remediation guidance was written for.
By Intellinative Research Team ·
Key takeaways
- On 24 September 2026 CERT-In rated an F5 BIG-IP APM heap overflow (CIVN-2026-0475) as critical and said it is being actively exploited.
- Cisco Secure Firewall ASA/FTD/FMC (17 Sep) and Check Point Security Management and Log Servers (18 Sep) were also rated critical. That puts three edge or management platforms in one week.
- CERT-In's May 2026 blueprint recommends fixing known-exploited flaws on internet-facing systems within 12 hours. The guidance is advisory, not statutory.
- The binding duties have not changed: incident reporting within 6 hours, 180 days of log retention in India, and an annual audit by a CERT-In empanelled auditor.
- CERT-In handled 29.44 lakh incidents in 2025, up 85% from 2023.
Twenty notes in nine days, with the network edge at the top
CERT-In's vulnerability notes list shows CIVN-2026-0457 to CIVN-2026-0476 published between 16 and 24 September 2026. Most were routine. The four below matter more, because they affect devices that sit in front of everything else: remote-access gateways, firewalls, security management servers and DNS.
| Note | Date | Product | Severity | Why it matters |
|---|---|---|---|---|
| CIVN-2026-0475 | 24 Sep | F5 BIG-IP APM | Critical · exploited | Heap overflow (CVE-2026-94127). CERT-In says an attacker with no login can run code remotely when APM is configured as an OAuth Authorization Server. |
| CIVN-2026-0464 | 17 Sep | Cisco Secure Firewall ASA / FTD / FMC | Critical · exploited | Two flaws exploited in the wild. Cisco's hardening release of 16 Sep has no workarounds. |
| CIVN-2026-0465 | 18 Sep | Check Point Security Management & Log Servers | Critical | Code execution as root before login (CVE-2026-91843). Whoever controls the management server controls the firewall policy. |
| CIVN-2026-0467 | 21 Sep | ISC BIND | High | 14 CVEs, with risks including DNS cache poisoning and changes to zone data. |
- 20 CERT-In vulnerability notes, 16–24 Sep 2026 (CERT-In)
- 3 critical edge or management platforms in one week, two of them exploited (CERT-In notes)
- 29.44 lakh cyber incidents handled by CERT-In in 2025 (PIB)
- +85% rise in incidents, from 15.92 lakh (2023) to 29.44 lakh (2025) (Lok Sabha reply via TechObserver)
What CERT-In's 12-hour guidance says, and what it does not
On 25 May 2026, CERT-In released a Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (Khaitan & Co). The Hacker News gives its reference as CISG-2026-02 (THN). The blueprint's premise is that AI shortens the time between a vulnerability being disclosed and being exploited.
AI-assisted cyber exploitation reduces the time required for adversaries to identify, weaponize, and exploit vulnerabilities. — CERT-In blueprint, May 2026, as quoted by The Hacker News
| Exposure | Recommended remediation window |
|---|---|
| Known-exploited vulnerability on an internet-facing system | 12 hours |
| Critical vulnerability on an externally exposed system | 1 day |
| High-severity vulnerability | 5 days |
The blueprint also recommends SBOMs and AI bills of materials (AIBOMs), inventories of AI systems, and audit logging plus emergency shutdown for agentic AI (Khaitan & Co). The inventory point is the one that decides whether 12 hours is achievable. You cannot fix a device within 12 hours if it takes you a day to find out you own it.
The CERT-In obligations every Indian organisation still has to meet
| Obligation | Requirement | Source |
|---|---|---|
| Incident reporting | Report covered cyber incidents within 6 hours of noticing them | Directions, 28 Apr 2022 |
| Log retention | Keep ICT logs for a rolling 180 days within India | Directions, 28 Apr 2022 |
| Time sync | Synchronise clocks to NIC or NPL NTP servers | Directions, 28 Apr 2022 |
| Provider records | Data centres, VPS, cloud and VPN providers keep customer records for 5 years | Directions, 28 Apr 2022 |
| Security audit | At least annually and after every major change, by a CERT-In empanelled auditor. Findings scored with CVSS and EPSS and mapped to CWE/CVE. Report shared with CERT-In within 5 days of completion. | Audit Policy Guidelines, 25 Jul 2025 |
If you are a bank or NBFC, the same six-hour window now also applies to reporting on RBI's DAKSH platform. See our RBI 2026 directions briefing. If you process personal data, a 72-hour report to the Data Protection Board is coming as well (DPDP countdown).
Running a 12-hour clock on an exploited edge vulnerability
- T+0 to 1h · Triage Match the CERT-In note against your asset inventory, covering product, version and exposed interface. For F5, check whether APM is configured as an OAuth Authorization Server. Record who decided and when.
- T+1 to 3h · Contain If a patch cannot go in yet, reduce exposure: restrict management planes to jump hosts, apply vendor mitigations or a WAF or IPS virtual patch, and take non-essential portals offline.
- T+3 to 8h · Hunt Pull the 180 days of retained logs for the device. Look for the vendor's published indicators, new admin accounts, configuration changes and unusual outbound connections. If you find compromise, the six-hour reporting clock starts.
- T+8 to 12h · Remediate and evidence Patch or upgrade, rescan and confirm the fixed version. Record timestamps for every step. This record is what shows an auditor or supervisor that you met the 12-hour intent.
Controls that make 12 hours realistic
- A live inventory of internet-facing assets, including cloud load balancers and SaaS-exposed endpoints
- Management interfaces that are never exposed to the internet
- Pre-approved emergency change windows for edge devices
- Vendor advisories and CERT-In feeds routed into the SOC ticket queue
- Priority set by CVSS, EPSS and CISA KEV status, plus whether the asset is exposed
- A tested rollback plan for firewall and gateway upgrades
Intellinative's managed security service runs this workflow 24x7 alongside our partners, including runtime protection with Sysdig for container workloads. See Kubernetes as a Service, or the air-gapped GST platform case study for how we segment and monitor critical platforms.
Frequently asked questions
Is CERT-In's 12-hour patching guidance legally mandatory?
No. The May 2026 blueprint uses "where feasible" and "should endeavor" wording. The binding CERT-In duties come from the April 2022 Directions: 6-hour incident reporting, 180-day log retention in India, and NTP synchronisation.
Does the 12-hour window mean the patch must be installed?
Not necessarily. Isolating the system, restricting access or applying a vendor mitigation within 12 hours, and then patching, meets the intent of cutting exposure quickly. Record every step with timestamps.
Which September 2026 CERT-In alerts should be patched first?
F5 BIG-IP APM (CIVN-2026-0475, actively exploited), Cisco Secure Firewall ASA/FTD/FMC (CIVN-2026-0464, two flaws exploited) and Check Point Security Management and Log Servers (CIVN-2026-0465, critical). ISC BIND (CIVN-2026-0467, high) comes next.
How long must logs be retained under CERT-In rules?
For a rolling 180 days, stored within Indian jurisdiction, under the CERT-In Directions of 28 April 2022. The DPDP Rules separately require at least one year for logs related to personal data processing.
How often is a CERT-In cyber security audit required?
At least once a year and after every major change, by a CERT-In empanelled auditor. Under the July 2025 guidelines, findings are scored with both CVSS and EPSS, and the report is shared with CERT-In within 5 days of the audit finishing.
How many incidents did CERT-In handle in 2025?
29.44 lakh, according to PIB, up from 20.41 lakh in 2024 and 15.92 lakh in 2023. CERT-In also issued 1,530 alerts, 390 vulnerability notes and 65 advisories in 2025.
Sources
- CIVN-2026-0475: Heap-based Buffer Overflow Vulnerability in F5 BIG-IP APM · CERT-In · 24 Sep 2026
- CIVN-2026-0464: Multiple Vulnerabilities in Cisco Secure Firewall · CERT-In · 17 Sep 2026
- CIVN-2026-0465: Vulnerability in Check Point Security Management · CERT-In · 18 Sep 2026
- CIVN-2026-0467: Multiple Vulnerabilities in ISC BIND · CERT-In · 21 Sep 2026
- Vulnerability Notes 2026 · CERT-In · Accessed 26 Sep 2026
- CERT-In Directions under Section 70B(6) · CERT-In · 28 Apr 2022
- Comprehensive Cyber Security Audit Policy Guidelines v1.0 · CERT-In · 25 Jul 2025
- CERT-In: India's Frontline Defender against Cyber Threats · PIB · 23 Jan 2026
- Cisco Secure Firewall ASA, FMC and FTD hardening release · Cisco · 16 Sep 2026
- CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks · The Hacker News · 26 May 2026
- CERT-In professes 12-hour patching for AI-assisted attacks · The Register · 27 May 2026
- Ergo: CERT-In AI Cybersecurity Blueprint · Khaitan & Co · 2 Jun 2026
- CSA Research Note: CERT-In 12-hour patch mandate · Cloud Security Alliance · 26 May 2026
- India cyber security incidents hit 29 lakh in 2025 · TechObserver · 15 Aug 2026