CISA Shortens Patch Deadline for Critical Ivanti and SolarWinds Vulnerabilities

What happened

The Cybersecurity and Infrastructure Security Agency (CISA) shortened patch deadlines for multiple actively exploited vulnerabilities affecting SolarWinds Web Help Desk and an Ivanti product after adding them to its Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies were ordered to patch CVE-2025-26399, a critical vulnerability in SolarWinds Web Help Desk, by Thursday. The flaw, first discovered by Trend Micro’s Zero Day Initiative, has been repeatedly patched and is reportedly being exploited in the wild. CISA also added two additional vulnerabilities to the KEV list, including CVE-2026-1603 affecting an Ivanti product that defenders say has been exploited since mid-February. The agency typically provides agencies three weeks to apply patches but shortened the timeline in this case due to active exploitation risks. 

Who is affected

Federal civilian agencies using SolarWinds Web Help Desk and Ivanti products are directly affected, as they must apply patches within the shortened deadlines mandated by CISA. 

Why CISOs should care

The shortened deadlines signal heightened concern from CISA that the vulnerabilities may be actively targeted, particularly given previous cyber incidents involving SolarWinds software and repeated exploitation of Ivanti products by threat actors. 

3 practical actions

1. Apply patches for SolarWinds Web Help Desk immediately. Agencies were given a shortened deadline to remediate CVE-2025-26399. 
2. Update vulnerable Ivanti systems. Address CVE-2026-1603 and related vulnerabilities added to the KEV catalog. 
3. Review KEV catalog remediation timelines. Monitor CISA directives when patch deadlines are shortened due to active exploitation.

The patch directive comes as the U.S. cybersecurity leadership landscape evolves following the Senate confirmation of Joshua Rudd to lead the NSA and U.S. Cyber Command.

John Kevin Hao

+ postsBio ⮌

John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.

• John Kevin Hao

  Insight Partners And Glilot Capital Co-Lead $20M Investment In Way Security To Reinvent IAM Operations
• John Kevin Hao

  Daylight Security’s Viral Videos Reimagine The Black Hat Experience For CISOs
• John Kevin Hao

  Fig Extends Platform Coverage to the Entire SecOps Engineering Lifecycle, Setting Resilience as the Default
• John Kevin Hao

  Upwind Investigation Into AsyncAPI npm Packages Highlights a More Coordinated Form of Supply Chain Attack