CISA directive orders agencies to prioritize vulnerability patching in a new way

CISA issued Binding Operational Directive 26-04 requiring federal agencies to prioritize and remediate vulnerabilities according to four criteria (publicly exposed asset, automated exploitability, takeover capability, and evidence of active exploitation). The directive sets strict timelines — including a three-day remediation and forensic triage requirement for vulnerabilities meeting all four criteria — and requires agencies to update vulnerability management policies, remediate known exploited vulnerabilities, and adjust patching processes within 60 to 180 days; the guidance is framed in part by concerns about AI accelerating vulnerability discovery and weaponization.