CISA mandates risk‑based patching with 3‑day deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new federal mandate requiring agencies to adopt a risk-based approach to patching software vulnerabilities, with the most critical flaws now requiring remediation within three days. The directive, Binding Operational Directive 2604, was released on Wednesday, June 10, 2026, and supersedes previous patching orders from 2019 and 2021.

The new framework prioritizes vulnerabilities based on four criteria: whether the flaw is listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog; whether the affected asset is publicly exposed to the internet; whether an adversary can automate all steps to exploit it; and whether successful exploitation grants an attacker partial or total control of the system. Vulnerabilities meeting all four criteria must be patched within three days, and agencies must also conduct forensic triage to determine if a compromise occurred prior to remediation. For flaws meeting fewer criteria, agencies are given longer timelines or may defer patching until the next scheduled system upgrade.

CISA officials framed the shift as a necessary response to the accelerating pace of cyber...