In brief

For years, the US government's patching rules said, roughly: fix internet-facing critical bugs fast, and fix anything on CISA's "known exploited" list by a deadline. In June, CISA replaced both rules with one that asks a smarter question: how much risk does this flaw create on this system? It's written for US federal agencies, but it's one of the best free patching playbooks any IT team can borrow.

What changed?

Binding Operational Directive 26-04, issued on June 10, 2026, focuses patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally. It revokes BOD 19-02 and BOD 22-01, the two rules it replaces.

CISA's reason is speed. It warns that attackers' use of AI may further narrow the time defenders have to react between a patch being released and attacks starting.

The four questions

Urgency comes from four questions:

  1. Exposure: can people on the internet reach the vulnerable system?
  2. Known exploited: is the flaw on CISA's Known Exploited Vulnerabilities list?
  3. Automation: can an attacker automate every step needed to exploit it? If yes, attacks can run at scale.
  4. Impact: does the attacker gain partial control or total control of the system?

CISA publishes answers to the last three for every published vulnerability. Your team supplies the first: is it exposed?

From three days to the next upgrade

At the urgent end, agencies must fix the flaw within three days and carry out a forensic triage: check whether the system was already compromised. That's a recognition that, for the worst bugs, patching late means checking for intruders too.

At the other end, low-risk flaws can wait until the next scheduled major upgrade or rebuild. That frees people to work on what matters.

The timeline also moves with the facts. Taking a system off the internet is a valid mitigation that pushes its deadline back; a flaw newly added to the exploited list pulls it forward. Agencies have 180 days to start meeting the new timelines.

Who does it apply to?

US federal civilian agencies. It does not apply to contractors unless their contract says so. But the logic travels well, including to Indian businesses that have been patching by severity score alone.

How to borrow it

  • Know what's exposed. Keep a current list of every system reachable from the internet. Without it, the first question can't be answered.
  • Watch the exploited list. Subscribe to CISA's KEV catalog updates and treat a match on an exposed system as an emergency.
  • Ask whether it gives partial or total control. A flaw that hands over the whole system outranks one that leaks a little.
  • Check for compromise on the worst ones, not just patch them.
  • Write down what can wait, and fold it into planned upgrades.

Sources