CISA orders federal agencies to replace end-of-life edge devices

CISA issued Binding Operational Directive 26-02 requiring U.S. federal agencies to identify, inventory, and remove end-of-support (EOS) network edge devices (routers, firewalls, switches) because they no longer receive security updates and are being actively targeted by exploitation campaigns; the directive sets timelines (inventory in 3 months, decommission within 12 months for prior-EOS devices, full replacement within 18 months, and continuous discovery within 24 months) and urges all network defenders to follow its guidance.