Skip to content
Menu

Security operations · Guide

How to meet CERT-In’s 12-hour patch window.

CERT-In’s blueprint of 25 May 2026 gives known exploited flaws on internet-facing and crown-jewel systems 12 hours to patch, mitigate or remove exposure, “where feasible”1. Promise it only for a short, named list of systems, each with a pre-approved emergency change.

Written by
NetScale IT Services
Published
Sources checked
Read
10 minutes
On this page

The facts

What came out between April and June 2026?

If every patch waits for the monthly release and a slot at the weekly change board, a fix can take weeks to reach production. CERT-In’s blueprint of 25 May 2026 asks for 12 hours on known exploited vulnerabilities in internet-facing and crown-jewel systems, “where feasible”1. It calls its remediation timelines indicative1.

The blueprint came in a run of announcements, in date order:

Table 1. April to June 2026: who published what
DateWhoWhat it saysForm
7 April 2026AnthropicProject Glasswing: Claude Mythos Preview has found thousands of high-severity vulnerabilities, some in every major operating system and browser2.Company announcement
23 April 2026Finance Minister with RBI, MeitY and bank chiefsBanks to assess AI risks and take pre-emptive measures3.Meeting, as reported
26 April 2026CERT-InCIAD-2026-0020: “aim to apply” critical patches “within 24 hours of release”4.Advisory, severity High
5 May 2026SEBICircular naming Claude Mythos: patch “on immediate basis”, with virtual patching as an interim option where no patch exists5.Circular under section 11(1), SEBI Act, 1992
25 May 2026CERT-InCISG-2026-02, the blueprint: remediation in 12 hours to 5 days, and a 60-day roadmap16.Guideline
10 June 2026CERT-InCISG-2026-03: requirements for original equipment manufacturers (OEMs) and technology providers7.Guideline
June 2026RBIBoard-approved AI gap assessment, with an action plan by the end of June8.Press report; RBI text not found

The facts

What does the 12-hour rule say?

Section 9 of the blueprint sets “Indicative Risk-Based Remediation Timelines” by type of finding1. The wording below is CERT-In’s.

Table 2. CISG-2026-02, section 9: remediation expectations by finding type1
Finding typeExpectation, in the blueprint’s wordsWindow
Known exploited vulnerability affecting internet-facing and crown-jewel systems“Immediate containment; patch, mitigate, or remove exposure within 12 hours where feasible.”112 hours
Critical externally exposed vulnerability“Patch, mitigate, or remove exposure within 1 day.”11 day
Known exploited vulnerability affecting internal systems“Patch or mitigate within 1 day unless compensating controls are implemented and documented.”11 day
Critical internal vulnerability affecting high-value systems“Patch or mitigate within 3 days.”13 days
High-severity vulnerability“Patch or mitigate within 5 days based on risk prioritisation.”15 days
No patch available“Implement temporary mitigation measures such as isolation, access restriction, WAF/API protection, enhanced monitoring, or feature disablement until remediation becomes available.”1Until a fix exists

Three details in the wording are easy to miss. “Where feasible” appears on the 12-hour row only1. “Mitigate” and “remove exposure” sit beside “patch” on the first two rows1. The row for internal systems allows compensating controls, if they are “implemented and documented”1.

The table does not say when each clock starts. CERT-In’s April advisory counts its 24 hours from the release of a patch4.

CERT-In lists the blueprint as a security guideline, and the blueprint itself says organisations should implement it “in a risk-informed manner”16. It does not cite section 70B(6) of the IT Act, the power behind the CERT-In Directions of 28 April 202219. Those Directions require listed incidents to be reported “within 6 hours of noticing” them, and the blueprint repeats that duty19. Applicability is for your counsel.

The facts

How fast are vulnerabilities being exploited now?

Rapid7, drawing on its incident response and vulnerability data, counted 146 exploited high and critical-severity vulnerabilities in 2025, against 71 in 202410. For those flaws, the median time from publication to CISA’s known exploited list fell from 8.5 days to 5.010.

Verizon’s 2026 breach report finds that 31% of breaches now start with a software vulnerability, ahead of stolen passwords11. That is a first in the report’s 19-year history12. The data covers incidents from 1 November 2024 to 31 October 202511.

Remediation went the other way. Across the organisations Verizon measured, only 26% of the vulnerabilities on CISA’s known exploited list were fully remediated, down from 38% a year earlier12. The median time to fully patch a vulnerability rose to 43 days, from 3212.

The blueprint names no model. It lists “automated vulnerability discovery and exploit development” among the traits of AI-assisted exploitation1.

The facts

What do SEBI, RBI and the OEM guideline add?

SEBI’s circular of 5 May 2026 is addressed to stock exchanges, clearing corporations, depositories, brokers, mutual funds, portfolio managers and other market intermediaries5. Of the 10 measures in its Annexure-A, these bear on patching and exposure5:

  • Update all operating systems and applications “on immediate basis”; where no patch exists, virtual patching “can be considered” as an interim measure5
  • Run vulnerability assessments with conventional tools and “suitable AI based” tools where possible5
  • Engage third-party vendors to release timely patches5
  • Document every change, minor ones included, with impact analysis, review and testing5
  • Keep an API inventory, with rate limiting and allow-listed connections5
  • Keep an asset inventory and a software bill of materials (SBOM) for critical applications, open source included5

The circular also announces a task force, cyber-suraksha.ai, whose mandate includes sharing threat intelligence and reviewing the security posture of third-party application service providers5.

For banks the record is thinner. Outlook Business reported on 10 June 2026, citing Business Standard, that RBI asked for a board-approved gap assessment of AI preparedness8. An action plan was due by the end of June8. We did not find RBI’s own text.

CERT-In’s guideline of 10 June 2026 covers OEMs and technology providers operating in India, managed service providers included7. Notice of critical and high-severity flaws should go to affected organisations and to CERT-In “immediately upon discovery or confirmation”, with interim mitigation guidance7.

Its indicative patch times for IT products split two ways7. A critical flaw that “could likely be exploited using AI” calls for an emergency release; one reported through responsible disclosure gets 5 days7.

What it means

What does this mean for your patch programme?

A monthly cycle cannot meet 12 hours or 1 day, and neither can a 43-day median12. In 12 hours there is no time to find out who owns a system or who can approve the change. Those answers have to exist before the advisory arrives.

Much of the internet-facing estate runs vendor code: firewalls, VPN gateways, email gateways, load balancers. CERT-In’s April advisory says older VPN appliances “have repeatedly been used as entry points by attackers”4. For those, your clock waits on the vendor’s fix, and CISG-2026-03 sets out what the vendor should send you7.

SEBI-regulated entities, and reportedly banks, also have their own regulator’s ask58. For everyone else, the blueprint is the document an auditor or a customer can point to after an incident.

Capacity is the other limit. In ISC2’s workforce study, 97% of 524 respondents in India reported at least one skills need13. More than half said they feel overwhelmed by their workloads13. A 12-hour window on a Saturday needs a named person who is not already on another incident.

What it means

What should you check on Monday?

Each step leaves something you can show an auditor.

  1. List every internet-facing system: public IP ranges, DNS names, VPN and remote access gateways, firewall management interfaces, APIs and cloud load balancers. Check the list against an external scan of your own ranges.
  2. Mark the crown jewels: the systems whose loss stops the business or exposes regulated data. Keep the 12-hour list short enough for one team to handle inside 12 hours.
  3. Name an owner and a deputy for each system on the list, with phone numbers that answer on a Sunday.
  4. Subscribe to CISA’s known exploited list, which has CSV and JSON feeds, and to each vendor’s advisories14. Match both to your list automatically.
  5. Rank the rest by exploit likelihood as well as severity. The blueprint names the Exploit Prediction Scoring System (EPSS)1. It is FIRST’s estimate of the probability that a published vulnerability (CVE) is exploited in the wild in the next 30 days15.
  6. Agree an emergency change path with the change board: who approves, what test is enough and how to roll back. The blueprint lists “emergency remediation” under patch management1. If you are SEBI-regulated, pre-write the impact analysis and review that the circular expects for every change5.
  7. Write each system’s mitigation before it is needed: a web application firewall (WAF) or API rule, an isolating access list, a feature to switch off1.
  8. Decide what starts each clock and write it into the patch policy: the vendor’s release, the known exploited listing or your own detection.
  9. Record two times for every finding: time to mitigate and time to patch. Report both to the board, with the open exceptions. The blueprint lists remediation tracking and exception handling under patch management1.
  10. Ask each vendor for what CISG-2026-03 says they should provide: immediate notice of critical and high flaws, interim mitigations, rollback steps and an escalation contact7.
  11. Rehearse once. Take a past known exploited vulnerability in a product on your list and time the path from advisory to mitigation.

What it means

How do the 60 days become a project plan?

Section 13 sets a roadmap in three phases1. Add an evidence column and it becomes a project plan.

Table 3. CISG-2026-02, section 13: the roadmap, with the evidence to keep1
PhaseWhat the blueprint listsEvidence to keep
Days 0 to 7: immediate risk reductionGovernance and accountability; critical assets and internet-facing systems identified; multi-factor authentication (MFA) for critical access; critical and known exploited vulnerabilities patched; incident reporting and escalation set up; security logging switched on1The short list with owners; MFA coverage; the escalation path in writing
Days 8 to 30: operational strengtheningSecurity operations centre (SOC) and monitoring strengthened; continuous vulnerability and attack surface management; AI governance and an AI system inventory; tabletop exercises, ransomware simulations and backup restoration tests1Scan schedule and results; the AI system inventory; tabletop and restore test records
Days 31 to 60: advanced resilience and adaptive securityRed team exercises and adversarial simulations; continuous control validation; adversarial AI testing1Red team findings with fixes and retests; control test results

The 60 days are tight for an estate without a current asset list. If yours has none, spend the first 7 days building it.

Our view

Should you promise 12 hours across the whole estate?

No. A 12-hour window is achievable for a short list, not for an estate. We would write the list first. Every entry gets an owner, a tested rollback and a pre-approved emergency change. Only that list gets the 12-hour promise.

We would measure time to mitigate alongside time to patch, because the blueprint counts mitigation as meeting the window1. A mitigation inside the window, then a tested patch within days, is a better record than an untested patch rushed in at the last hour.

Scan your own estate with the AI-assisted tools attackers are adopting, on a schedule, before the advisory arrives1. SEBI asks for AI-based assessment tools where suitable, and CISG-2026-03 asks vendors for AI-assisted testing too57.

The counter-view is fair: a customer or a regulator may read 12 hours as a promise for everything. Point them to the document’s own words: “indicative”, “where feasible” and “risk-informed”1. Where a sector regulator writes a firmer number into a circular, plan to that number. And with only a handful of internet-facing systems, skip the list and do them all in 12 hours.

Limits

What is for counsel, and what is out of scope?

Whether the blueprint or a sector circular binds your organisation, and what RBI asked of you, are for your compliance team and counsel. Operational technology gets longer vendor timelines in CISG-2026-037; this piece is about IT.

Where we fit

Who can find the exposure and check the fix?

Our managed SOC and MDR service scans public-facing systems, VPN, APIs and internal infrastructure, and retests every fix. It starts with a readiness review of log sources, detection gaps and 6-hour reporting: free, in writing and yours either way. NetScale is not a CERT-In empanelled auditor. Where your regulator requires an empanelled audit, we work alongside the auditor and fix what they find.

Questions readers ask

Is CERT-In’s 12-hour patch rule mandatory?

It is published as guidance: CERT-In lists the blueprint as a security guideline, which calls its timelines indicative and applies the 12 hours “where feasible”16. The 6-hour incident report is set by the Directions of 28 April 2022, which say entities “shall mandatorily report”9. Sector regulators can add their own asks, as SEBI did on 5 May 20265. Applicability is for your counsel.

Which systems need patching within 12 hours?

Internet-facing and crown-jewel systems with a known exploited vulnerability, where feasible1. Critical externally exposed flaws and known exploited flaws on internal systems get 1 day1. Critical flaws on internal high-value systems get 3 days, and high-severity flaws 5 days1. Every row accepts a mitigation in place of a patch1.

Does the 12-hour clock start at disclosure or at patch release?

The blueprint does not say1. CERT-In’s April advisory counts its 24 hours from the release of a patch4. Write your own start point into the patch policy, and use the same one in every report to the board.

References

  1. 1Indian Computer Emergency Response Team (CERT-In). Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (CISG-2026-02, Version 1.0). 25 May 2026. cert-in.org.in (opens in a new tab)
  2. 2Anthropic. Project Glasswing: Securing critical software for the AI era. 7 April 2026, updated 6 October 2026. anthropic.com (opens in a new tab)
  3. 3Business Today. Mythos threat: FM Sitharaman holds meet with RBI, MeitY, banks on systemic risks from AI. 23 April 2026. businesstoday.in (opens in a new tab)
  4. 4Indian Computer Emergency Response Team (CERT-In). Defending Against Frontier AI Driven Cyber Risks (CERT-In Advisory CIAD-2026-0020). 26 April 2026. cert-in.org.in (opens in a new tab)
  5. 5Securities and Exchange Board of India. Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection (like Mythos), circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026. 5 May 2026. sebi.gov.in (opens in a new tab)
  6. 6Indian Computer Emergency Response Team (CERT-In). CERT-In Guidelines. Listing. cert-in.org.in (opens in a new tab)Checked
  7. 7Indian Computer Emergency Response Team (CERT-In). Guidelines regarding AI-Accelerated Vulnerability Protection and Response Requirements for Original Equipment Manufacturers (OEMs), and Technology Providers (CISG-2026-03, V 1.0). 10 June 2026. cert-in.org.in (opens in a new tab)
  8. 8Outlook Business. RBI Moves to Shield Banks From Emerging AI Threats. 10 June 2026. outlookbusiness.com (opens in a new tab)
  9. 9CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. 28 April 2022. cert-in.org.in (opens in a new tab)
  10. 10Rapid7 (news release). Rapid7 2026 Global Threat Landscape Report Shows Exploited High and Critical-Severity Vulnerabilities Surged 105% as Attack Timelines Collapsed. 18 March 2026. s29.q4cdn.com (opens in a new tab)
  11. 11Verizon Business. 2026 Data Breach Investigations Report. Undated. verizon.com (opens in a new tab)Checked
  12. 12Help Net Security. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector. 20 May 2026. helpnetsecurity.com (opens in a new tab)
  13. 13ISC2. ISC2 Research: India’s Cybersecurity Workforce Reaches a Turning Point: Skills, AI and Retention Define the Next Challenge. 24 September 2026. isc2.org (opens in a new tab)
  14. 14Cybersecurity and Infrastructure Security Agency (CISA). Known Exploited Vulnerabilities Catalog. Continuously updated. cisa.gov (opens in a new tab)Checked
  15. 15FIRST. Exploit Prediction Scoring System (EPSS). Undated. first.org (opens in a new tab)Checked

Changes

  • First published.

Written by NetScale IT Services. How these guides are written

  1. Security operations10 minutes

    Ransomware in India: who to report to, how fast and how to recover.

  2. Infrastructure and networks11 minutes

    Windows 10 ESU, Server 2016 and SQL Server 2016: the dates to 2027.