CISA Orders Federal Agencies to Adopt Risk-Based Vulnerability Patching

CISA issued Binding Operational Directive 26-04 requiring U.S. federal civilian agencies to prioritize vulnerability remediation by risk instead of treating all flaws as equally urgent. The directive tells agencies to rank vulnerabilities using four factors: whether the affected asset is public-facing, whether exploitation can be fully automated, whether compromise could enable full system takeover, and whether there is evidence of active exploitation, including inclusion in CISA’s Known Exploited Vulnerabilities catalog. Based on those criteria, agencies now face remediation deadlines ranging from three days for the highest-risk cases to 60 days for lower-priority flaws, while some low-risk issues may be deferred until a planned major system upgrade.

CISA said the overhaul is meant to help agencies “patch smarter, not harder” as AI shortens the time between disclosure and weaponization and defenders struggle with limited resources. Agencies must immediately update vulnerability management policies, revise remediation processes within 60 days, and fully implement the directive’s timelines within 180 days; vulnerabilities meeting all four criteria also require forensic triage to determine whether systems were already compromised before patching. CISA said an initial review at one large civilian agency found only about 1% of vulnerability instances would require the three-day response, while more than 60% could be deferred, and the agency urged private-sector organizations to adopt similar risk-based practices alongside hardening, segmentation, and phishing-resistant MFA.