Correction: a field value inside an enrichment file was read as the time an agency marked exploitation active
Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.
- id
- CHQ-CORR-2026-038
- class
- CORRECTION
- subtype
- editorial
- status
- IN FORCE
- authority
- DM ratified 2026-11-12
- effective
- 2026-11-12
- published
- 2026-11-12
- title
- Correction: a field value inside an enrichment file was read as the time an agency marked exploitation active
- what was wrong
- The row for a SonicWall SSL VPN entry (SN-2026-11-07-01) and internal briefings of 7 and 8 November 2026 read a timestamp inside the agency's enrichment file, 19:20:53 UTC on 6 November, as the time the agency marked exploitation active, seventeen minutes after disclosure.
- what is true
- That value is one of three field values in the file describing one state. None is the time the agency reached its finding or the time the file became public; the file's first recorded commit is on 7 November. The authoritative finding time is the catalog listing itself, 19:44:45 UTC on 6 November.
- what changed
- The row and the two briefings are left as written with a dated correction appended. Issue No. 46 states the correct reading.
- what did not change
- No count, rating, Outlook or Watch. The candidate was held for want of a dated exploitation under either reading.
- control analysis
- A machine timestamp was given a meaning its source does not state. The correct reading had already been reached in a separate analysis of the same file and was not carried back to the row.
- found by
- CHQ, while drafting Issue No. 46 against the retained records.