CISA Rewrites Federal Patching Requirements for AI Threat Era

CISA's new Binding Operational Directive (BOD 26-04) introduces a tiered, risk-based federal patching mandate that requires federal civilian executive branch agencies to remediate the most dangerous vulnerabilities within three days and perform forensic triage, while allowing lower-risk issues to be deferred; the directive relies on CISA's KEV catalog, exploit-automation metadata, and new asset-tagging schemas and sets 60- and 180-day implementation deadlines, with industry experts noting operational and data-quality challenges in meeting the aggressive timelines.