Magento Got 21 Days to Patch Last Year. Now It Gets Three.

In October 2025 the United States added a flaw in Adobe Commerce to its list of vulnerabilities known to be under active attack, and gave federal agencies twenty-one days to fix it.

In September 2026 it added two more. Each came with a three-day deadline.

Four years of twenty-one days

CISA's Catalog of Known Exploited Vulnerabilities is a list of software flaws that someone has been caught exploiting in the wild. It now holds 1,741 entries. Every one carries the date it was added and the date by which federal civilian agencies must have remediated it.

Subtract one from the other and you get the window. For four years it barely moved. The median was 21 days in 2022, 21 in 2023, 21 in 2024 and 21 in 2025 — 1,173 entries across those four years, and 21 days is the most common window on 1,025 of the catalogue's entries overall.

In 2026 the median is 3.

Two steps, not one

Month by month the change comes in two moves rather than a single announcement.

The median holds at 21 days every month from January 2025 through February 2026. In March, April and May 2026 it is 14. From June 2026 onward it is 3, in every month including the eleven entries added so far in October.

The last entry anywhere in the catalogue to carry a 21-day deadline was added on 5 March 2026. The first three-day deadline arrived earlier, on 27 January 2026, against a Fortinet flaw, but it was an outlier for four months before it became the rule.

Of the 134 entries added since 1 June 2026, 106 carry three days and 28 carry fourteen. Not one carries twenty-one.

What that looks like from a checkout

Adobe Commerce and Magento Open Source have appeared in the catalogue five times. The windows they were given run 14 days, 21, 21, 3, 3.

The two three-day entries came sixteen days apart in September 2026. The twenty-one-day entry before them was eleven months earlier.

SAP appears fourteen times, ten of those for NetWeaver. Adobe appears eighty-two times in total; Flash Player is thirty-three of them and ColdFusion sixteen, which is a reminder that most of this catalogue is not about commerce at all. Twenty-six of the 1,741 entries name something in the commerce or payments path on HaiPay's reading, and that reading is indicative rather than exhaustive.

Who this actually binds

It is worth being blunt about this, because the number is easy to misread. These deadlines bind United States federal civilian agencies under Binding Operational Directive 22-01. They do not bind merchants, acquirers, gateways or anyone else.

What they do is set a public, dated expectation of how fast a known-exploited flaw ought to be closed, published by a government that can see incident reporting the rest of us cannot. Card scheme rules, insurers, enterprise customers and procurement questionnaires have all tended to converge on whatever that number is.

Which is why a change from twenty-one days to three is worth noticing even if you have no federal obligation at all. The benchmark moved by a factor of seven, and it moved without most of the industry's patch cycles moving with it.

Why this matters

A three-day window is shorter than a lot of change-freeze policies. It is shorter than many merchants' regression test cycles. For a platform like Adobe Commerce, which sits directly in the checkout path and is typically customised, three days from disclosure to patched-in-production is a demanding target and an honest one to plan against.

The practical question is not whether you are legally covered by the directive. It is whether, if a flaw in your commerce platform appeared on that list tomorrow, you could be patched by Friday. The catalogue has made that question measurable, and it has quietly made the answer harder.

What this is not

This is not a measurement of how fast anyone actually patches. The catalogue records deadlines set by CISA, not remediation that occurred. No completion data is published, and none is implied here.

The deadlines apply to US federal civilian agencies only. No merchant or payment firm is required by CISA to patch within any of these windows.

The 2021 median of 181 days reflects the catalogue's opening batch, which carried one distant deadline for a large backlog of older flaws. It was not a policy of six-month windows, and it is shown separately for that reason.

The commerce and payments subset of 26 entries comes from HaiPay's keyword selection across vendor, product and vulnerability name. It is indicative, not exhaustive, and a different keyword list would return a different number.

The catalogue is amended continuously. These are the figures in version 2026.10.13, released on 13 October and downloaded on 14 October 2026. HaiPay did not contact CISA or any vendor named here.

What to watch

Whether three days holds or compresses further. Six entries in the catalogue's history have carried a one-day deadline, all of them in 2025, against Citrix, Microsoft and Cisco products.

Whether fourteen days survives as the softer tier. Twenty-eight of the 134 entries since June still carry it, which suggests CISA is grading severity rather than applying one rule to everything.

And whether anything in the payments stack lands on the list next. Five Adobe Commerce entries in four years is not a pattern yet. A sixth, with a three-day window, would start to be one.