CISA's BOD 26-04 sets a three-day deadline for the most serious actively exploited flaws
POLICYCISAredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
US government agencies must now fix the most dangerous actively exploited software flaws within three days, and check whether they were already breached at the same time. CISA issued the new rule on 10 June 2026, replacing older one-size-fits-all deadlines. Contractors handling federal data are expected to follow the same standard.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Identify internet-facing assets and check whether any are affected by KEV-listed vulnerabilities.
- Where patching cannot be done within three days, isolate or uninstall the vulnerable software as a compensating control.
- Capture volatile evidence such as memory and registries before applying patches to systems that may be compromised.
- Contractors and cloud providers handling federal data should confirm they meet the directive's requirements.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Rapid7 Blog
Who and what is in it
Companies