Policy · 1 source · latest 1h

CISA's BOD 26-04 sets a three-day deadline for the most serious actively exploited flaws

POLICYCISAredteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

CISA issued Binding Operational Directive 26-04 on 10 June 2026, replacing BOD 19-02 and BOD 22-01. It ranks vulnerabilities by asset exposure, KEV listing, automatability and technical impact, instead of CVSS alone. Tier 1 flaws, which are on the KEV catalogue and grant total control, must be patched within three days alongside a forensic triage.

For IT people · Written by AI from 1 source · Wrong?

What to do

Identify internet-facing assets and check whether any are affected by KEV-listed vulnerabilities.
Where patching cannot be done within three days, isolate or uninstall the vulnerable software as a compensating control.
Capture volatile evidence such as memory and registries before applying patches to systems that may be compromised.
Contractors and cloud providers handling federal data should confirm they meet the directive's requirements.

Written by AI from the sources, checked against them

Read the full story at the source