CISA Sets 72-Hour Patch Window for Federal Systems Facing Highest Cyber Risks

CISA issued Binding Operational Directive 26-04, a risk-based vulnerability remediation framework that requires federal civilian agencies to patch the highest-risk vulnerabilities—especially those that are actively exploited, automatable, and internet-facing—within 72 hours, mandates compromise assessments before remediation when full control is possible, consolidates previous BOD requirements, and gives agencies 180 days to update policies in response to AI-driven acceleration of exploit activity.