BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities.

<p>Introduction Three days. That&#8217;s how long federal agencies now have to patch their riskiest vulnerabilities, and for the first time, a high CVSS score alone won&#8217;t land a vulnerability in that bucket. On June 10, 2026, CISA issued Binding Operational Directive (BOD) 26-04, &#8220;Prioritizing Security Updates Based on Risk.&#8221; It replaces two long-standing directives, BOD [&#8230;