IC Technology & Surveillance — 2026-06-11

CISA Issues Binding Directive Requiring Federal Agencies to Patch Critical Exploited Vulnerabilities Within Three Days

BLUFCISA's new forensic triage mandate before patching exposes a capability gap most civilian agencies cannot close within the 180-day compliance window without external support.

CISA on June 10 issued BOD 26-04, ordering federal civilian agencies to remediate the highest-risk vulnerabilities within 72 hours, tiered against four criteria: public asset exposure, KEV catalog listing, automatable exploitation, and degree of adversary control 123. The directive mandates forensic triage before patching when adversaries can achieve total system control, on CISA's stated basis that patching alone does not evict a threat actor already present 13. Agencies have 60 days to update vulnerability management processes and 180 days to meet the new tiered timelines 12. CISA analysis at one large federal agency found only 1% of vulnerabilities fell into the three-day category, while over 60% could be deferred to routine update cycles 23.

Analysis
The forensic triage requirement is BOD 26-04's sharpest departure: agencies must triage for threat-actor presence before patching, reversing the patch-first instinct embedded in prior directives. That step demands in-house capability most civilian agencies do not maintain. CISA's own pilot data puts the 3-day workload at roughly 1% of federal vulnerability volume. If that rate holds enterprise-wide, most agencies face too little high-tier exposure for the capability gap to bite in practice. The 180-day implementation window concentrates compliance risk: agencies that reach that deadline without functional triage workflows face either non-compliance or the hazard of patching over active intrusions. CyberScoop, The Record, and BleepingComputer independently cover the same announcement without cross-sourcing, corroborating the official record.

4 sources

BOD 26-04: Prioritizing Security Updates Based on Risk - CISA
CISA directive orders agencies to prioritize vulnerability patching in a new way - CyberScoop
CISA to require federal agencies to patch some cyber vulnerabilities within 3 days - The Record
CISA tells govt agencies to patch critical exploited flaws in 3 days - BleepingComputer