CISA retires 10 emergency cyber orders in rare bulk closure

CISA announced it has retired 10 Emergency Directives issued between 2019 and 2024, determining that required mitigations are complete or now covered by Binding Operational Directive 22-01, which leverages the Known Exploited Vulnerabilities (KEV) catalog to enforce patch deadlines. The retired directives span major issues such as SolarWinds Orion, Microsoft Exchange, Pulse Secure, Windows Print Spooler, and VMware, and CISA emphasized that patch timelines can be significantly accelerated for high-risk cases, citing recent one-day deadlines for Cisco CVEs.