{"id":270572,"date":"2026-06-11T11:00:00","date_gmt":"2026-06-11T15:00:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/11\/cisa-orders-agencies-to-patch-by-risk-not-severity\/"},"modified":"2026-06-11T16:15:11","modified_gmt":"2026-06-11T20:15:11","slug":"cisa-orders-agencies-to-patch-by-risk-not-severity","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/11\/cisa-orders-agencies-to-patch-by-risk-not-severity\/","title":{"rendered":"CISA Orders Agencies to Patch by Risk, Not Severity"},"content":{"rendered":"

CISA Orders Agencies to Patch by Risk, Not Severity<\/a><\/p>\n

https:\/\/www.infosecurity-magazine.com\/news\/cisa-orders-agencies-to-patch-by\/<\/a><\/p>\n

Publish Date: 2026-06-11 11:00:00<\/a><\/p>\n

Source Domain: www.infosecurity-magazine.com<\/a><\/p>\n

US federal agencies have been instructed to overhaul their vulnerability management practices, shifting away from rigid, deadline-driven patching toward a risk-based approach that prioritizes the most actively exploited threats, under new guidance from the Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

Binding Operational Directive 26-04, issued on June 10, ties each deadline to risk: three days, plus a forensic check for signs of intrusion, for the most dangerous flaws, with longer windows for less severe combinations and deferral for genuinely low-risk bugs, in some cases until a system’s next major upgrade. It consolidates two previous mandates, BOD 19-02 and the KEV-focused BOD 22-01.<\/p>\n

CISA cast it as a response to a threat picture in which AI helps attackers find and weaponize bugs faster, shrinking defenders’ window once a patch ships, as the volume of disclosed flaws outpaces blanket patching.<\/p>\n

The directive also pairs its tightest deadlines with a forensic step.\u00a0When an agency patches the most serious flaws, it must check whether attackers have already exploited them, since a fix rarely evicts an intruder.<\/p>\n

Read more on CISA directives: CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws<\/p>\n

Risk Replaces the Severity Score<\/strong><\/h2>\n

For years, CVSS severity scores drove prioritization, BOD 26-04 drops that.\u00a0Revoking the old directive means agencies are no longer required to use CVSS to prioritize, since, as CISA noted, a severity label alone doesn’t dictate what to fix first.<\/p>\n

The directive instead weighs four factors:<\/p>\n