CORRECTION — Microsoft did revise its Windows IKE Extension record after the KEV listing, and it left the not-exploited determination in place; the CERT-EU advisory in the same argument relays no research firm

UPDATE · originally covered Five CVEs this week where the exploitation flag came apart — four where two authorities disagree outright, in both directions and once in this constituency's own national feed, and one where no feed had a flag to disagree about (2026-08-23)

two factual corrections to the earlier entry, one of which sharpens its central claim and one of which withdraws a supporting one. The argument itself survives both.

Microsoft's Windows IKE Extension record was revised, and the revision is the more interesting fact. The original entry stated three times that Microsoft's record for CVE-2026-33824 had not been revised since it was published on 14 April 2026, and used that as evidence that the vendor's not-exploited determination was simply stale relative to CISA's 2026-08-18 catalogue addition. Microsoft's record carries a latest-revision date of 2026-08-20 — two days after the KEV listing — with the revision described as adding clarifying information to the mitigation and explicitly marked an informational change only, and the record still states the flaw is not exploited, with an exploitability assessment of "Exploitation Less Likely" and a base score of 9.8 (Microsoft Security Response Center, 2026-08-20). The original also described the gap between publication and the reporting date as a matter of weeks; from 14 April to 21 August is four months.

The correction cuts in the entry's favour. A record left untouched for four months is plausibly just unmaintained, and that reading gave the vendor an excuse the evidence does not support. A record a vendor returned to after the national catalogue listed the flaw as exploited, edited, and left saying not-exploited is a considered position. The disagreement between the two authorities is therefore firmer than the entry claimed, not softer, and a defender reconciling the two feeds is looking at two live opinions rather than one live opinion and one stale page.

The CERT-EU half of the NetScaler example is withdrawn. The original entry wrote that Switzerland's national advisory for CVE-2026-19490 recorded active exploitation on the strength of a single social-media post, while CERT-EU's advisory of 19 August "and the research firm it relays" both recorded no observed exploitation. CERT-EU's advisory references only the vendor's own knowledge-base article and makes no exploitation statement in either direction (CERT-EU, 2026-08-19). Only the Swiss advisory cites a research firm. The observation that survives is narrower and still worth having: one national authority moved a flaw onto its exploited feed on thin sourcing while a peer authority's advisory says nothing about exploitation at all — an absence of a determination, which is a different thing from a contrary determination and should not be counted as corroboration for either side.