CISA says it is about to change how U.S. federal agencies handle software flaws, telling them to focus first on the vulnerabilities and systems that pose the highest real-world risk. Acting Director Nick Andersen said a binding operational directive due Wednesday will shift agencies away from treating every patch the same and toward prioritizing internet-exposed assets, Known Exploited Vulnerabilities, exploit automation, and critical functions; CISA also plans closer risk reviews with critical infrastructure operators.
Eduard Kovacs
2026.09.17
93% relevant
This article adds that CISA is retiring its weekly vulnerability bulletin on September 28 as a direct follow-on to BOD 26-04, reinforcing the shift from broad CVE summaries to risk-based prioritization centered on KEV, alerts, and advisories.
2026.09.16
87% relevant
This article is a direct follow-up to CISA's June shift to risk-based vulnerability management, adding that the agency will discontinue its weekly vulnerability bulletin on September 28 and steer users toward the KEV catalog, cybersecurity advisories, and the CVE catalog instead.
Ionut Arghire
2026.06.11
98% relevant
This article is a direct report on the same CISA event: issuance of Binding Operational Directive 26-04. It adds specific details on agency obligations, including policy updates, KEV monitoring, automation of reporting, external asset tagging, and the 3-day, 14-day, and 60-day remediation timelines tied to exploitability, exposure, and impact.
Bill Toulas
2026.06.11
97% relevant
This article appears to be coverage of the same underlying event: CISA's new Binding Operational Directive 26-04. It adds concrete detail on the accelerated remediation windows, including a three-day deadline for certain internet-exposed, actively exploited, automatable flaws that allow partial or full system compromise, plus 60-day and 180-day implementation milestones for FCEB agencies.
2026.06.10
97% relevant
This article is a direct update on the same CISA binding operational directive, adding the specific 72-hour requirement for vulnerabilities meeting three of four criteria, the criteria themselves, the 180-day implementation window, and the requirement to perform compromise triage before patching.
2026.06.09
100% relevant
The article establishes a new, specific CISA policy event: an imminent binding operational directive that will alter federal vulnerability prioritization and remediation requirements.