CISA Orders Agencies to Patch by Risk, Not Severity

CISA's Binding Operational Directive 26-04 replaces CVSS-driven patching with a risk-based vulnerability management approach that ties remediation deadlines to factors such as public exposure, KEV listing, exploit automation, and technical impact; the directive mandates rapid patching and forensic checks for the most dangerous flaws while allowing longer windows or deferrals for lower-risk issues, and urges agencies and private operators to adopt the new prioritization framework.