Microsoft PKI Services self-reported a missed seven-day incident-report update deadline and completed remediation

Microsoft PKI Services self-reported that it missed the required seven-day update deadline for open incident report Bugzilla 2059818 because no future "Next update" date had been recorded in the Bugzilla Whiteboard. The overdue update was posted on 2026-08-24, about three days and seven hours after the 2026-08-21 deadline. Microsoft said the issue was limited to the timeliness of the incident-report update and did not affect certificate issuance, validation, revocation, or subscribers. In its closure summary, Microsoft explained that its monitoring control tracked action-item changes but did not calculate the default seven-day deadline when no Whiteboard date existed. Microsoft also reported that the remediation actions were completed and requested closure, and CCADB later posted a final call for comments saying the report would be closed on approximately 2026-10-05 if there were no further comments.

1. 2026-07-31 Microsoft PKI Services opened Bugzilla 2059818.
2. 2026-08-14 Microsoft PKI Services posted an update to Bugzilla 2059818 without recording a future next-update date.
3. 2026-08-21 The required seven-day update deadline passed without a new update being posted.
4. 2026-08-24 Microsoft PKI Services posted the overdue update to Bugzilla 2059818.
5. 2026-09-25 Microsoft PKI Services filed a closure summary stating that the remediation actions were completed.
6. 2026-10-05 CCADB indicated the report would be closed approximately on this date if no further comments were received.

1. 2026-08-26 Microsoft Corporation — Microsoft filed a preliminary incident report saying it missed the seven-day update deadline for Bugzilla 2059818.
2. 2026-08-28 Microsoft Corporation — Microsoft requested that the next update date be aligned with the Full Incident Report due date of 2026-09-08.
3. 2026-09-04 Microsoft Corporation — Microsoft filed the full incident report, explaining the internal monitoring gap and stating that no certificates were affected.
4. 2026-09-04 Microsoft Corporation — Microsoft requested that the next update date be aligned with the remaining action item due date of 2026-09-25.
5. 2026-09-25 Microsoft Corporation — Microsoft filed a report closure summary and requested closure after stating that all action items had been completed.
6. 2026-09-27 CCADB representative — CCADB posted a final call for comments or questions and said the report would be closed on approximately 2026-10-05.