CISA Directive BOD 26-04 Mandates Risk-Based Patching for US Federal Agencies (infosecurity-magazine.com)

• New directive replaces severity-based patching with four risk factors
• Three-day remediation with forensic check for critical vulnerabilities
• Agencies must comply by December 7, 2026

"The US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04 on June 10, 2026, requiring federal agencies to prioritize security updates based on risk factors—asset exposure, KEV status, exploit automation, and technical impact—rather than CVSS severity scores. The directive replaces previous mandates, sets remediation timelines ranging from three days to the next major system upgrade, and adds a forensic check for intrusion signs on critical flaws. Agencies have 180 days to achieve compliance."