SecurityForbes Innovationabout 2 hours ago
CISA Shrinks Patch Window to Three Days
4 min read
In June 2026, CISA issued Binding Operational Directive 26-04, replacing CVSS-driven deadlines with a four-variable risk model. The directive allows just three calendar days for vulnerabilities meeting specific criteria, citing AI-accelerated exploitation as the rationale for this shift in federal civilian agency patching requirements.
Level
Hype check
Tap to vote and see what everyone thinks.