Which dates matter in a vulnerability disclosure?
A severity score describes how bad a flaw is. The dates describe how exposed you are, and they are usually spread over weeks: a fix is released, downstream operators are told, an advisory or CVE is published, exploitation is confirmed, and eventually the full technical details become public. Each step changes who knows what.
| Date | Example from our reporting | What it means for a defender |
|---|---|---|
| Fix released | Zimbra 10.1.20 on 20 July 2026 | The bug is now readable in the diff by anyone who looks |
| Operators notified | Cosmos EVM chains told on 21 August, two days after an open fix on 19 August | Whoever read the commit had a head start |
| Advisory or CVE published | Zimbra CVE on 13 August; Cosmos halt advice on 22 August | Scanners may already be ahead of you |
| Exploitation confirmed | Windows IKE flaw patched in April, added to CISA's KEV on 18 August with a three-day deadline | The age of the patch no longer protects anyone who skipped it |
| Details made public | GitLab publishes issue details 90 days after a fix | The window for quiet patching closes on a known date |
Why is a patch itself a disclosure?
Microsoft's tracking of CVE-2026-73570, an unauthenticated command injection in Zimbra's SNMP notification path, is the clearest case we have reported. The fix shipped in Zimbra 10.1.20 on 20 July and the CVE was published on 13 August. Between 28 July and 7 August Microsoft saw two distinct scanning tools probing the injection point later used in attacks, built to confirm execution without delivering anything.
The Cosmos EVM incident shows the same mechanism in a smaller ecosystem. A fix for an underflow in the staking precompile was published openly on 19 August; downstream chains were notified on 21 August; the recommendation to halt and upgrade went out on 22 August, by which point three chains had been drained — on TAC, about 2.98 billion tokens, 62% of circulating supply. KiiChain's objection was that a public fix published before the chains running the code were told privately hands the bug to anyone reading the commit.
What does a critical patch release actually contain?
GitLab's critical patch release of 12 October is a useful template for reading one. The headline was CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 that let an unauthenticated user run code on the server. The same release fixed 24 issues: one critical, five high, fourteen medium and four low, including prompt injection into GitLab Duo agent instructions and cache poisoning of raw repository files. GitLab.com was already patched; self-managed installations were told to upgrade immediately, and one version line skipped straight to a later build because the previous one broke merge request pages.
How old can a patch be and still be urgent?
Old enough to be forgotten. CVE-2026-33824, a double-free in the Windows IKE service reachable on UDP 500 and 4500, was fixed in April's Patch Tuesday. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 August and gave federal civilian agencies three days. The ports are the ones a VPN concentrator listens on by design, which is why the patch was still missing in enough places to matter and why blocking the ports is not a simple fallback.
What do breach notices leave out?
Breach notification follows its own, slower clock. Heights Finance discovered an intrusion through a third-party cloud platform on 7 May and notified 734,828 customers around 10 August — roughly three months later. Its statement that monitored forums showed no sign of the data is a statement about what the monitoring covered, not about where the data is.
RingCentral disclosed its incident on 28 July and described the cause only as sophisticated social engineering. The public count of 1.6 million affected accounts arrived on 14 August, two and a half weeks later, and came from Have I Been Pwned rather than from the company.
Do bug bounties change the timeline?
They decide who reports first. Bounty caps are typically set against security budgets rather than value at risk, so for a protocol holding hundreds of millions a six-figure ceiling asks a finder to accept a fraction of the bug's worth on the other side. Programmes that scale payouts to funds at risk report better inbound quality, and they remain a minority.
Disclosure does not mean every part of your stack treats the flaw as known. Trail of Bits found Intel tools that let firmware with a known vulnerability pass attestation for a year after disclosure — a default worth checking wherever attestation gates trust.
Questions
- Does the risk start when a CVE is published?
- Often earlier. In the Zimbra case Microsoft tracked, scanning for the injection point began on 28 July, after the fix shipped on 20 July but before the CVE was published on 13 August. A released fix can be read by attackers before defenders are told what it is for.
- Why would an old patch suddenly get a three-day deadline?
- Because exploitation was confirmed. The Windows IKE flaw was fixed in April, but when CISA added it to the Known Exploited Vulnerabilities catalogue on 18 August it gave federal agencies three days, a statement about what CISA was seeing rather than about the flaw's score.
- How long can a breach notice take?
- In cases we reported, about three months from discovery to customer notice at Heights Finance, and two and a half weeks between RingCentral's disclosure and a public count of affected accounts, which came from Have I Been Pwned.
- What does a patch release with one critical flaw usually contain?
- Much more than the headline. GitLab's critical release of 12 October fixed 24 issues across four severity levels, and several of the high and medium ones affected pipelines and AI agent instructions rather than the flaw in the title.