Digital Law Weekly Tracker: W37 2026 — SEBI and RBI Launch "Demat 2.0," India's First Native-DLT Tokenised Corporate Bond Pilot Settled in Wholesale Digital Rupee, While CERT-In Logs Thirteen Vulnerability Notes Including a Chrome Zero-Day Google Confirms Is Under Active Exploitation

India's digital-law week of 7 to 13 September 2026 was dominated by financial-market infrastructure rather than by data-protection or AI law. On 10 September 2026, at the Global Fintech Fest in Mumbai, SEBI and RBI jointly launched "Demat 2.0" — a pilot issuing corporate bonds as native digital tokens on a private, permissioned DLT network owned by the depositories, settled through RBI's wholesale digital rupee using atomic delivery-versus-payment. SEBI's own 24-question FAQ confirms the token remains a security under the Securities Contracts (Regulation) Act, 1956, needs no new demat account, no fresh KYC and no investor-managed private keys. Separately, CERT-In logged thirteen vulnerability notes, including a Chrome zero-day, CVE-2026-87491, which CERT-In's own note records Google has confirmed is being exploited in the wild.

At a Glance — W37 Scoreboard

TL;DR for Founders

Three things to act on this week:

1. If you issue or hold corporate bonds, or advise on debt-capital-markets deals: a pilot now exists for issuing bonds as native tokens settled in central-bank digital money, and SEBI has been explicit that this does not create a new asset class or dilute existing investor protections. Nothing is mandatory yet — the pilot is confined to SEBI's Regulatory Sandbox — but the operational mechanics (CBDC wallets, atomic settlement, depository-held private keys) are worth understanding before a client asks about it.

2. If you run a Chrome fleet at any scale: CERT-In's note on CVE-2026-87491 records that Google itself has confirmed active exploitation. Update to Chrome 153.0.8010.36/.37 (Windows/Mac) or 153.0.8010.36 (Linux) now — this is not a theoretical CRITICAL rating, it is a vendor-confirmed live attack.

3. If your estate runs Dell Secure Connect Gateway, HPE Aruba Networking Fabric Composer or Keycloak: three CRITICAL notes this week carry unusually large CVE counts or hit identity infrastructure directly — Keycloak's flaw is an authentication bypass, the kind of defect that undermines every control built on top of it. Patch-verify these three specifically before the general backlog.

Top 3 Developments

1. SEBI and RBI Put a Bond on a Ledger, and Insist Nothing Legal Has Changed (Fintech and Payments)

What happened: On 10 September 2026, at the Global Fintech Fest in Mumbai, SEBI and RBI jointly announced the successful launch of "Demat 2.0," a pilot testing the issuance, holding, trading and settlement of corporate bonds in tokenised form using Distributed Ledger Technology (DLT) (SEBI Press Release No. 56/2026). SEBI published a 24-question FAQ the same day — read in full for this tracker directly from sebi.gov.in — which is unusually candid about what the pilot does and does not change.

The mechanics, in SEBI's own words. The corporate bond is issued as a native digital token on a private, permissioned DLT network owned by the Depositories — "the token is the corporate bond," not a certificate representing it. The bond's key terms (coupon rate, payment dates, day-count convention, redemption terms) are encoded into the token through a smart contract, which can execute coupon, redemption and other scheduled corporate actions automatically based on ledger holdings on the relevant record date, reducing the need for manual reconciliation between institutions.

What legally stays the same — and this is the FAQ's central message:

• A tokenised bond remains a security under the Securities Contracts (Regulation) Act, 1956, and continues to be governed by applicable SEBI regulations. It retains the same ISIN, issuer obligations, coupon, maturity, covenants, rating, security and investor rights as a conventional dematerialised bond. Tokenisation changes only the record-keeping technology — it does not create a new asset class.
• The depository remains the statutory authoritative record of beneficial ownership under the Depositories Act, 1996. The DLT ledger is the form in which that record is maintained for the pilot; it does not displace the depository's statutory role.
• A freeze, attachment or direction applicable to a demat account or the relevant ISIN/token holding applies to the linked tokenised holding as well — existing legal controls carry over unchanged.
• No separate credit rating is required merely because a bond is tokenised, and investment eligibility for institutional investors is unaffected, since eligibility turns on the security's characteristics (status, listing, rating, issuer, dematerialised form), not the underlying database technology.

How settlement works. Issue proceeds and coupon/redemption payments move through the issuer's CBDC wallet, opened under RBI's wholesale e-rupee pilot. The securities leg and the CBDC funds leg are linked through the DLT infrastructure so that they settle atomically — SEBI's FAQ defines this as atomic Delivery-versus-Payment (DvP): either both legs settle, or neither does, eliminating the conventional interval between trade and settlement and the counterparty exposure that interval creates.

What investors and issuers do and do not need to do. Investors need no new demat account and no fresh KYC — a "Demat 2.0 account" is an extension of the existing demat account, registered by linking it to a CBDC wallet through the existing depository interface. Investors do not manage cryptographic private keys themselves; the depositories hold and manage the keys on investors' behalf. Issuers need a CBDC wallet but not a Demat 2.0 account of their own. The FAQ states plainly that no separate technology infrastructure or investment is envisaged for either issuer or investor.

The regulatory basis, and why that matters. The FAQ states the pilot is conducted under SEBI's Regulatory Sandbox, with any specific relaxation "provided within the sandbox framework and for a defined scope and period" — not under a new statutory instrument. This is a controlled experiment, not a rule change, and the FAQ is explicit that the objective is to "test the architecture and operational arrangements before a broader regulatory framework is considered." The rollout is planned in three stages: Stage I covers institutional issuance through the existing Electronic Bidding Platform; Stage II enables secondary-market trading with retail access, with an interim peer-to-peer/demat-to-demat transfer mechanism available before then for exit liquidity; Stage III contemplates extending ledger-node access to credit rating agencies, depository participants and other regulated entities. Infrastructure development and operation sits with SEBI's Market Infrastructure Institutions, with technology and implementation support from NPCI; nodes are initially run by the depositories and stock exchanges.

Why this matters for a compliance function — Veritect analysis. The single most consequential line in the FAQ is not about blockchain — it is the confirmation that a tokenised bond is a security under the existing SCRA framework, meaning it triggers no new licensing question, no new investor-protection gap and no new tax characterisation issue by virtue of the technology alone. That reduces this from a "new instrument" legal question to an "operational integration" question: whether an issuer's treasury function can operate a CBDC wallet, whether a depository participant's existing KYC and AML controls extend cleanly to the linked account, and whether internal audit trails can be reconciled against a permissioned ledger rather than a conventional database. For a debt-capital-markets practice, the near-term work is advisory rather than contentious — helping issuers and investors understand an optional rail that changes settlement mechanics without changing legal character.

A gap, stated as a gap (§5.10): market reporting the same week named specific issuers, issuance amounts and coupon rates for initial pilot transactions. This tracker does not repeat those figures. They were not corroborated against a primary SEBI or RBI disclosure at the time of authoring, and per this platform's source-discipline rule this tracker reports only what SEBI's own press release and FAQ state, which describe the pilot's mechanics but do not themselves disclose transaction-level figures. Treat any specific rupee amount or issuer name circulating in market press as unverified against a primary record until a SEBI or RBI filing confirms it.

2. Thirteen CERT-In Notes in Four Days, and One Is a Vendor-Confirmed Live Attack (Cybersecurity)

What happened: Between 7 and 10 September 2026 CERT-In issued thirteen vulnerability notes, CIVN-2026-0441 through CIVN-2026-0453, plus two advisories: CIAD-2026-0044 (9 September, Microsoft Products) and CIAD-2026-0045 (10 September, SAP Products). Every note below was opened and read individually for this tracker.

The one that matters most. CIVN-2026-0450 (9 September) is the week's most urgent item not because of its severity label — CERT-In rates it HIGH, not CRITICAL — but because of what it says about exploitation. The note records that CVE-2026-87491, an out-of-bounds write vulnerability in Chrome's V8 JavaScript engine, is a flaw Google has specifically confirmed is being exploited in the wild. That is a materially stronger evidentiary basis than most active-exploitation claims this tracker has logged in prior weeks, where CERT-In records exploitation without disclosing whether the finding is its own or a vendor's. Here, the vendor confirmation is explicit. Remediation: update to Chrome 153.0.8010.36/.37 (Windows/Mac) or 153.0.8010.36 (Linux).

The identity-infrastructure flaw. CIVN-2026-0442 covers an authentication bypass in Keycloak, the open-source identity and access management platform widely embedded behind single sign-on deployments. CERT-In rates it CRITICAL. An authentication-bypass defect in an identity broker is categorically more dangerous than a defect in any single downstream application, because every service that trusts Keycloak's authentication decision inherits the exposure — this is the same reasoning this tracker has applied in prior weeks to SIEM and segmentation-layer defects (W35) and to the log-analytics and segmentation stack generally: patch state for infrastructure that other controls are built on top of deserves board-level visibility distinct from the general vulnerability backlog.

The volume outliers. CIVN-2026-0449 (Dell Secure Connect Gateway) lists 100 CVE identifiers in a single note — an unusually large single-product disclosure — and CIVN-2026-0446 (HPE Aruba Networking Fabric Composer) lists 48, spanning unauthenticated remote code execution, authentication bypass, privilege escalation and denial of service. Large CVE counts of this kind typically reflect a consolidated vendor patch cycle rather than a single newly discovered class of defect, but the operational consequence for a patch team is the same: both products sit in network-management and remote-access infrastructure, the same functional category this tracker flagged as a recurring CERT-In theme in prior weeks (W36's SonicWall SMA1000 and Zimbra active-exploitation notes; W35's Splunk, Cisco Secure Workload and NetScaler CRITICAL cluster).

PaperCut, treated cautiously. CIVN-2026-0445 rates the PaperCut NG/MF Application Server flaws CRITICAL. CERT-In's note itself does not state that these specific CVEs are under active exploitation; it references a third-party report describing an earlier PaperCut emergency patch for exploited flaws. This tracker does not extend that earlier report to the current CVEs without CERT-In's own confirmation, consistent with this platform's rule against treating a vendor's or a third party's account as CERT-In's own finding.

Why the compliance posture changes — Veritect analysis. The CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, require mandatory reporting of listed cyber incidents within six hours of noticing them or being brought to notice. A vendor-confirmed exploited CVE like CVE-2026-87491 does not itself trigger that clock — the clock activates on an actual incident within the listed categories, not on the existence of a patchable vulnerability — but it materially compresses the time between "unpatched" and "compromised," because exploitation in the wild means attacker capability already exists and is being used. Non-compliance with a CERT-In direction, once a qualifying incident is actually noticed, attracts the Section 70B(7) penalty of up to one crore rupees, as substituted for the original one lakh rupees by the Jan Vishwas (Amendment of Provisions) Act, 2023 (Act 18 of 2023) with effect from 30 November 2023.

3. SEBI's Fintech Festival Crowns an Agentic-AI Compliance Tool (AI Governance)

What happened: SEBI's Securities Market TechSprint 2026, a national innovation challenge launched under the theme "Innovation in Action: Shaping Securities Market for Tomorrow," concluded at the Global Fintech Fest with a felicitation ceremony on 10-11 September 2026 (Press Release No. 57/2026), presided over by SEBI Whole Time Member Sandip Pradhan. Separately, Press Release No. 55/2026 (10 September) records that the SEBI Chairman delivered a keynote address and participated in a panel discussion at the same event — the occasion on which Demat 2.0 (Item 1) was jointly unveiled with RBI.

Why it belongs in this tracker rather than a business-news roundup: one of the TechSprint's problem statements set participants the task of building agentic AI for regulatory-compliance automation — converting SEBI's own regulatory text into machine-actionable, auditable compliance logic for market intermediaries. That is a direct, if informal, signal of where SEBI's own technology posture is heading: from CSCRF's AI-vulnerability-detection advisory of 5 May 2026 (covered in earlier trackers) through the IT Resilience Index's insistence on system-driven, non-discretionary computation (W35) to a challenge explicitly inviting agentic-AI tooling for compliance itself, SEBI's pattern across 2026 has been to treat AI as an instrument of supervision and compliance infrastructure rather than solely as a risk to be regulated.

A gap, stated as a gap: SEBI's press releases for the TechSprint felicitation and the Chairman's keynote are headline-and-date items on SEBI's own surface; this tracker does not extend the winning-team or prize-amount detail found only in market reporting into a claim sourced to SEBI, for the same reason set out in Item 1's gap note.

Regulatory Action Log — Items 4 to 5

Research Gaps and Unretrieved Sources

Per CLAUDE.md §5.10, the following are recorded as gaps. None of them is a finding of silence unless expressly marked as portal-checked.

Checked at the issuing authority's own listing page, and genuinely empty of cyber/data/AI content for 7-13 September 2026:

• SEBI circulars — three circulars issued in the window (9 September: Commodity Derivatives position-limit penalty review; 7 September ×2: Angel Fund Accredited Investor timeline relaxation, FPI government-securities compliance ease). None carries cyber, data-protection or AI content.
• IRDAI circulars — the listing's most recent entry before the window is 28 August 2026; the next is 22 September 2026, outside the window. No IRDAI circular in the window.
• CERT-In advisories (CIAD series) — only CIAD-2026-0044 and CIAD-2026-0045, both logged in Item 2. No further advisory in the window.

Not retrievable, and therefore reported as unknown rather than absent:

• meity.gov.in — homepage and /whatsnew rendered without any dated content confirming or ruling out an instrument in the window.
• dot.gov.in/whatsnew — rendered without dated content.
• npci.org.in circulars path — unreachable.
• uidai.gov.in press-releases path — HTTP 404.
• tdsat.gov.in judgments path — no dated content retrieved.
• egazette.gov.in — no ministry-and-date search reachable for MeitY or DoT instruments in the window.

Transaction-level detail for the Demat 2.0 pilot — issuer names, issuance amounts and coupon rates circulating in market reporting were not corroborated against a primary SEBI or RBI disclosure and are deliberately omitted from Item 1. See the gap note under Item 1.

Live threads with no movement traced this week — constitution of the Data Protection Board of India under Section 18(1) of the DPDP Act, 2023 (no notification traced as at 13 September 2026; MeitY and eGazette could not be searched, so this is a retrieval gap, not a finding); DPDP Rules 2025 phased rollout; the Promotion and Regulation of Online Gaming Act, 2025 and its 2026 Rules; the synthetic-media labelling regime under the February 2026 IT Rules amendment; secondary-market trading infrastructure for Demat 2.0 (Stage II, no date fixed in the FAQ).

What's Next

Watch items with no fixed date: whether SEBI or RBI issues a formal circular translating the Demat 2.0 Regulatory Sandbox pilot into a published framework, as opposed to the press-release-and-FAQ basis on which it currently rests; whether a primary disclosure surfaces confirming the pilot's initial transaction-level figures; and whether CERT-In's Chrome note (CIVN-2026-0450) is followed by any Indian-sector-specific advisory, given the vendor-confirmed exploitation.

Founder Action Items

1. Read SEBI's Demat 2.0 FAQ before a client asks about it. It is short (24 questions, five pages), unusually direct, and answers the two questions every counterparty will ask first: is this a new asset class (no), and who holds the keys (the depositories, not the investor).
2. Patch Chrome today, not this sprint. CVE-2026-87491 is Google-confirmed exploited. Versions: 153.0.8010.36/.37 (Windows/Mac), 153.0.8010.36 (Linux).
3. Inventory Keycloak, HPE Aruba Fabric Composer and Dell Secure Connect Gateway deployments this week. One is an identity-bypass flaw; the other two carry unusually large CVE counts in network-management infrastructure.
4. Do not repeat unverified transaction figures for Demat 2.0 in client materials without a primary SEBI/RBI citation — this tracker deliberately omitted them for that reason.
5. If you run a TechSprint-style AI pilot internally, note SEBI's own direction of travel: agentic AI is being explored for compliance automation, not only flagged as a supervised risk category.

Practitioner Watch-List

• SCRA 1956 + Depositories Act 1996 remain the operative statutory anchors for Demat 2.0 — no new primary legislation has been introduced, and SEBI's FAQ is explicit that the pilot does not create a new asset class or dilute existing regulatory requirements (rating, listing, disclosure, valuation, classification, investor protection).
• SEBI Regulatory Sandbox is the correct framework reference for any client query about Demat 2.0's legal basis — not a circular, not a regulation amendment.
• Section 70B(7) IT Act 2000 remains at one crore rupees following the Jan Vishwas (Amendment of Provisions) Act, 2023 substitution effective 30 November 2023. Do not cite the pre-amendment one lakh figure.
• CERT-In vendor-confirmed exploitation (CIVN-2026-0450) is a stronger evidentiary basis than CERT-In's own unattributed exploitation claims seen in prior weeks — useful distinction when advising on the reasonableness of an organisation's patch-prioritisation decisions after the fact.
• MeitY and DoT portal availability remains a live research risk for the fourth consecutive tracker; where a client needs certainty on a MeitY or DoT instrument for a given week, insist on the eGazette record rather than the ministry website.

FAQ

What exactly did SEBI and RBI launch on 10 September 2026, and does it create a new kind of security?

No. "Demat 2.0" is a pilot, not new law, and SEBI's own FAQ is explicit that a tokenised corporate bond is not a new asset class. On 10 September 2026, at the Global Fintech Fest in Mumbai, SEBI and RBI jointly launched a pilot (SEBI Press Release No. 56/2026) testing the issuance, holding, trading and settlement of corporate bonds in tokenised form using distributed ledger technology (DLT). SEBI published a 24-question FAQ the same day, read in full for this tracker, which answers the asset-class question directly: a tokenised corporate bond remains a security under the Securities Contracts (Regulation) Act, 1956, and continues to be governed by the applicable SEBI regulatory framework, retaining the same ISIN, issuer obligations, coupon, maturity, covenants, rating, security and investor rights as a conventional dematerialised bond. What changes is only the technology used to record ownership: instead of a conventional database, the bond is issued as a native digital token on a private, permissioned DLT network owned by the depositories, and the token is the bond rather than a certificate representing it. The pilot is conducted under SEBI's Regulatory Sandbox — the FAQ states any specific relaxation required is provided within the sandbox framework for a defined scope and period — rather than under a new statutory instrument, and is explicitly intended to test architecture and operational arrangements before any broader regulatory framework is considered.

Does an investor need a new demat account, fresh KYC, or to manage cryptographic keys to hold a tokenised bond?

No to all three, and SEBI's FAQ addresses each directly. A "Demat 2.0 account" is an extension of the investor's existing demat account, not a separate account; the investor's existing KYC is used, and registration takes place through the existing depository interface by linking the eligible demat account with a CBDC wallet and providing consent. The depositories hold and manage the private keys on behalf of investors, so investors do not need to independently manage cryptographic keys or acquire specialised DLT infrastructure — from the investor's side, the holding continues to be managed through the existing depository interface and holding statement. A CBDC wallet, opened with the participant's own bank under RBI's e-rupee pilot, is the only additional arrangement, and the FAQ states no separate technology infrastructure or investment is envisaged for the issuer or investor. Existing legal controls carry over unchanged: a freeze, attachment or direction applicable to the demat account or the relevant ISIN/token holding applies equally to the linked tokenised holding, and the depository — not the ledger — remains the statutory authoritative record of beneficial ownership under the Depositories Act, 1996.

How does settlement actually work, and why is the central bank digital currency involved?

The securities leg and the payment leg are linked through the DLT infrastructure so that they settle atomically — SEBI's FAQ calls this atomic Delivery-versus-Payment (DvP): if the securities transfer succeeds, the CBDC payment succeeds; if either leg fails, the other does not settle. This removes the conventional interval between trade and settlement and, with it, the counterparty exposure that arises during that interval. RBI's wholesale central bank digital currency (e-rupee, under its ongoing pilot) supplies the funds leg because it is itself central-bank digital money that can be integrated into the same DLT infrastructure as the security. The issuer needs a CBDC wallet linked to its designated bank account to receive issue proceeds and make coupon and redemption payments; the FAQ describes this as the only additional arrangement required of an issuer, who does not need a Demat 2.0 account of its own.

What is CERT-In's most urgent finding this week, and what makes it different from a routine CRITICAL rating?

The most urgent item is CIVN-2026-0450, issued 9 September 2026 on Google Chrome for Desktop, because the note records that a specific vulnerability is not merely rated CRITICAL but is confirmed to be under active attack. CVE-2026-87491, an out-of-bounds write vulnerability in Chrome's V8 JavaScript engine, is described in CERT-In's note as one Google has specifically confirmed is being exploited in the wild — meaning the active-exploitation claim here is a vendor-confirmed fact that CERT-In is relaying. The recommended remediation is to update to Chrome version 153.0.8010.36/.37 on Windows and Mac, or 153.0.8010.36 on Linux. The same week also carried several CRITICAL-rated but not-confirmed-exploited notes with very large CVE counts — CIVN-2026-0449 on Dell Secure Connect Gateway lists 100 CVE identifiers, and CIVN-2026-0446 on HPE Aruba Networking Fabric Composer lists 48 — which is a volume signal distinct from the Chrome item's urgency signal.

Is a browser vulnerability like the Chrome zero-day actually within scope of CERT-In's mandatory six-hour incident reporting?

Not by itself. The six-hour clock under the CERT-In Directions of 28 April 2022 (issued under Section 70B(6) of the Information Technology Act, 2000) applies to listed categories of cyber incident that a body corporate notices or is brought to notice, not to the mere existence of a patchable vulnerability. A CVE being under active exploitation in the wild, as CERT-In records for CVE-2026-87491, does not itself trigger the clock for an organisation that has not experienced or detected an incident involving that vulnerability against its own estate. What it does is materially shorten the gap between an unpatched fleet and an actual incident, because exploitation in the wild means attacker capability already exists. Non-compliance with a CERT-In direction, once a qualifying incident is actually noticed, attracts the Section 70B(7) penalty of up to one crore rupees, as substituted for the original one lakh rupees by the Jan Vishwas (Amendment of Provisions) Act, 2023 (Act 18 of 2023) with effect from 30 November 2023.

Methodology and Date Provenance

• Window: ISO week 2026-W37, Monday 7 September 2026 to Sunday 13 September 2026, IST.
• Event dates: SEBI's Demat 2.0 announcement, the TechSprint felicitation and the Chairman's keynote are all dated to their own press-release date (10-11 September 2026), which is also the date of the underlying event (the Global Fintech Fest). CERT-In notes are dated by their own issue date.
• Exploitation status: where this tracker says a vulnerability is under active exploitation, that is stated exactly as CERT-In's note states it, with the CIVN-2026-0450 note further distinguished as recording a Google-confirmed finding rather than an unattributed CERT-In claim. CIVN-2026-0445 (PaperCut) is deliberately not described as confirmed-exploited, because CERT-In's own note does not make that claim for the current CVEs.
• Demat 2.0 transaction-level detail: deliberately omitted. See the gap note under Item 1 and in Research Gaps.
• Sources: every item was read at the issuing authority's own surface — sebi.gov.in press releases and the Demat 2.0 FAQ PDF (read in full), cert-in.org.in vulnerability-note and advisory indexes and individual note pages, trai.gov.in press releases. The FAQ PDF was downloaded and read directly rather than through a text-extraction proxy, after an initial proxy fetch failed to render body text — consistent with the recurring pattern this tracker series has recorded for SEBI PDF assets.
• What is not here: any item that could not be read at a primary source is recorded in the gaps section rather than summarised from elsewhere.

Primary Sources

• SEBI Press Release No. 56/2026, 10 September 2026 — Successful launch of "Demat 2.0" Pilot project for Tokenised Corporate Bonds: https://www.sebi.gov.in/media-and-notifications/press-releases/sep-2026/successful-launch-of-demat-2-0-pilot-project-for-tokenised-corporate-bonds_104418.html
• SEBI — FAQs on Demat 2.0: Pilot for Tokenised Corporate Bonds (24 questions): https://www.sebi.gov.in/sebi_data/faqfiles/sep-2026/1789049630065.pdf
• SEBI Press Release No. 55/2026, 10 September 2026 — Chairman, SEBI keynote at Global Fintech Fest 2026: https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=6&ssid=23&smid=0
• SEBI Press Release No. 57/2026, 11 September 2026 — Felicitation of Winners of Securities Market TechSprint at Global Fintech Fest 2026: https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=6&ssid=23&smid=0
• SEBI Circulars listing (Commodity Derivatives position limits, 9 Sep 2026; Angel Fund Accredited Investor relaxation and FPI compliance ease, 7 Sep 2026): https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=1&ssid=7&smid=0
• CERT-In Vulnerability Notes index, 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=VLNLIST02&year=2026
• CERT-In Vulnerability Note CIVN-2026-0450, 9 September 2026 (Google Chrome for Desktop, CVE-2026-87491 Google-confirmed exploited): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0450
• CERT-In Vulnerability Note CIVN-2026-0442, 7 September 2026 (Keycloak, authentication bypass, CVE-2026-18963, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0442
• CERT-In Vulnerability Note CIVN-2026-0446, 9 September 2026 (HPE Aruba Networking Fabric Composer, 48 CVEs, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0446
• CERT-In Vulnerability Note CIVN-2026-0449, 9 September 2026 (Dell Secure Connect Gateway, 100 CVEs, CRITICAL): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0449
• CERT-In Advisories index, 2026 (CIAD-2026-0044 Microsoft, CIAD-2026-0045 SAP): https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADVLIST02&year=2026
• TRAI Press Release No. 117/2026, 10 September 2026 — Standards of Quality of Service (Duration of Advertisements in Television Channels) (Repealing) Regulations, 2026: https://www.trai.gov.in/notifications/press-release
• IRDAI circulars listing: https://irdai.gov.in/circulars
• The Securities Contracts (Regulation) Act, 1956, and the Depositories Act, 1996 — read as cited within SEBI's own FAQ
• The Information Technology Act, 2000, Sections 70B(6) and 70B(7), as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023

Veritect Legal Intelligence. Tier 1 government and regulator sources only. This tracker reports facts drawn from primary records; analysis is original Veritect work. Where a primary record could not be retrieved, the gap is stated as a gap.