CISA tells govt agencies to patch critical exploited flaws in 3 days

CISA has issued Binding Operational Directive 26-04 requiring Federal Civilian Executive Branch agencies to prioritize and remediate high-risk vulnerabilities according to four factors (public exposure, Known Exploited Vulnerabilities catalog presence, automation potential, and degree of control gained) with timelines as short as three days and up to two weeks for lower-risk cases; agencies must update vulnerability management policies, asset inventories, and KEV reporting within set deadlines and continuously monitor asset metadata.