CISA BOD 26-04: The End of Patch-Everything and the Start of the 3-Day Clock

CISA's Binding Operational Directive 26-04 revises federal vulnerability patching by introducing a risk-based model prioritizing vulnerabilities by exposure, exploitability, and impact, with a strict 3-day fix mandate for highest-risk cases and graduated deadlines for others, replacing older flat deadlines. This aims to address patch fatigue and accelerated exploit weaponization driven by AI.

This Wire brief sits within Fusion42's coverage of Security Infrastructure.