The January 2027 CNSA 2.0 deadline is now seven months out, and this week’s threat activity makes the timing feel less like bureaucratic scheduling and more like a forcing function. Two of the most widely deployed federal perimeter devices — Palo Alto’s PAN-OS and Cisco’s Secure Firewall ASA/FTD — are under active exploitation or carrying unpatched denial-of-service vectors, while CIRCIA’s 72-hour incident reporting mandate has just been finalized. The window for orderly migration planning is closing faster than the calendar suggests.

CISA’s Emergency Directive ED 25-03, requiring federal agencies to inventory all Cisco Firepower and Secure Firewall devices and report to CISA by May 1, passed its deadline this week. Contractors supporting FedRAMP systems who missed that inventory requirement now face audit exposure — not a hypothetical risk. Meanwhile, CVE-2026-0300 in PAN-OS is an unauthenticated remote code execution vulnerability with a CVSS score of 9.3 that grants root access on PA-Series and VM-Series firewalls. CISA placed it on the Known Exploited Vulnerabilities catalog with a patch deadline of May 9. If your organization runs Palo Alto edge devices and has not verified patch status, the question is no longer whether attackers are scanning — it is whether they have already been in.

The Cisco ASA/FTD DoS vulnerabilities (CVE-2026-20105 and CVE-2026-20082) represent a different category of risk: memory exhaustion and TCP SYN flood attacks that can disable VPN connectivity for remote workers. In a federal contracting context where remote access is a mission requirement, VPN availability is not a convenience issue — it is a compliance and operational continuity issue.

The DAEMON Tools supply chain compromise on May 5 is worth flagging even if your organization does not use that specific tool. Trojanized software installers distributed through official channels are the attack pattern that compliance frameworks are least equipped to address quickly. NIST SP 800-161 supply chain risk management guidance applies here, but most federal contractors are still building those programs.

CIRCIA’s finalized regulations add a new procedural layer: 72-hour incident notification for covered entities, 24-hour reporting for ransomware payments. Organizations that have not yet built incident response runbooks that include these timelines should treat CIRCIA’s publication as a hard project start date.

The VPN Trust Initiative’s shift to annual reaccreditation is the week’s one constructive development. Contractors evaluating VPN vendors for remote work programs now have a consistent baseline: verify current audit credentials, not just historical ones.

The week’s lesson is straightforward: compliance deadlines and active exploitation are converging. Organizations treating CNSA 2.0 migration as a 2026 planning problem while their perimeter devices are being actively scanned are operating on assumptions the threat environment no longer supports.