CISA Retires Ten Legacy Emergency Directives as Agency Operates at One-Third Staffing Amid Iran Cyber Surge

CISA retired ten emergency directives this week, consolidating legacy mandates as the agency simultaneously grapples with a staffing crisis, operating at roughly one-third capacity after budget cuts and leadership departures. The consolidation coincides with CISA's busiest threat period, as Iranian cyber operations escalate against US targets during the conflict. The agency added CVE-2026-20131 to its KEV catalog with a Sunday deadline, even as shrinking capacity collides with growing threat volume.