# Correction: a field value inside an enrichment file was read as the time an agency marked exploitation active

- **Artifact ID:** CHQ-CORR-2026-038
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-038
- **Machine-record SHA-256:** `05792be5b540e4b88e5cecd124591723c452639dec6e2153771a0edaf2146437`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-038",
  "class": "CORRECTION",
  "subtype": "editorial",
  "status": "IN FORCE",
  "authority": "DM ratified 2026-11-12",
  "effective": "2026-11-12",
  "published": "2026-11-12",
  "title": "Correction: a field value inside an enrichment file was read as the time an agency marked exploitation active",
  "what_was_wrong": "The row for a SonicWall SSL VPN entry (SN-2026-11-07-01) and internal briefings of 7 and 8 November 2026 read a timestamp inside the agency's enrichment file, 19:20:53 UTC on 6 November, as the time the agency marked exploitation active, seventeen minutes after disclosure.",
  "what_is_true": "That value is one of three field values in the file describing one state. None is the time the agency reached its finding or the time the file became public; the file's first recorded commit is on 7 November. The authoritative finding time is the catalog listing itself, 19:44:45 UTC on 6 November.",
  "what_changed": "The row and the two briefings are left as written with a dated correction appended. Issue No. 46 states the correct reading.",
  "what_did_not_change": "No count, rating, Outlook or Watch. The candidate was held for want of a dated exploitation under either reading.",
  "control_analysis": "A machine timestamp was given a meaning its source does not state. The correct reading had already been reached in a separate analysis of the same file and was not carried back to the row.",
  "found_by": "CHQ, while drafting Issue No. 46 against the retained records."
}
```