the agent's KEV due-date math was off by one timezone - it flagged 12 CVEs as overdue that weren't due for a week
Fixes KEV due-date math that flags CVEs as overdue a week early because of a timezone mix-up. Use it when a triage agent marks CISA KEV entries overdue that are not actually due yet. Key trigger: the overdue list shifts by exactly the UTC offset of the agent's timezone.
TL;DR: Compare KEV due dates as calendar dates in UTC, not as local datetimes. The KEV catalog publishes due dates as dates with no time component, so converting them to midnight local time and comparing against UTC "now" shifts the verdict by your UTC offset. Parse the date, keep it a date, and compare against today's UTC date.
agent: 12 CVEs flagged overdue - KEV due dates are 7 days in the future- Pull one misflagged CVE's KEV entry and print the raw due-date string from the catalog. Expected: you see a plain date like 2026-10-15 with no timezone attached.
- Log how the agent parses it: check whether the date becomes a datetime at midnight local time. Expected: you find the conversion that introduces the offset.
- Change the comparison to date-only in UTC: parse the catalog value as a date object and compare it with the current UTC date. Expected: the same CVE no longer flags as overdue.
- Re-run the overdue check across the whole backlog. Expected: the 12 false overdues clear, and only genuinely past-due entries remain.
- Add a regression test with a due date one day out, run in a non-UTC timezone. Expected: the test fails on the old code and passes on the new.
Use this when
- KEV overdue flags are off by hours to a day
- due-date math runs in a non-UTC timezone
- catalog dates carry no time component
- the overdue list changes size when the agent moves timezones
Not for this skill when
- the KEV catalog data itself is stale or wrong
- the due dates are genuinely in the past
- the dispute is about remediation SLAs rather than KEV dates
- the catalog feed failed to parse at all
Variant phrasings
- KEV due date wrong timezone
- CVE flagged overdue too early
- CISA KEV date comparison off by one day
- BOD 22-01 due date miscalculated
Why it happens
A date-only value like 2026-10-15 parsed as midnight in a UTC-negative timezone is still the previous day in UTC. Comparing that datetime against "now" in UTC makes the CVE look overdue up to a full day early, and date-boundary arithmetic compounds the error across the backlog.
Edge cases
- daylight-saving transitions shift the offset by an hour - date-only comparison dodges this entirely
- some feeds do include timestamps - detect the format before assuming date-only
- agents in containers often default to UTC while developers test in local time, so the bug appears in only one environment
- KEV "date added" vs "due date" are different fields - make sure the math uses the due date
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_lRnKMjooDdc5hv7o742lZQ