CVSS Is Officially Dead: What CISA’s BOD 26-04 Means for Everyone

On June 10, 2026, CISA's BOD 26-04 formally moved federal vulnerability prioritization away from CVSS scores to an SSVC-driven four-question model (public exposure, known exploitation, automatability, technical impact), which assigns tiered remediation deadlines (3, 14, 60 days or defer). The article argues organizations must validate real exploitability against their controls — closing the "Exposure Decision Gap" — and promotes Picus's autonomous penetration testing, exposure validation, and breach-and-attack simulation as ways to provide rapid, defensible decisions under the new directive.