CISA BOD 26-04 Mandates 72-Hour Patch Deadline for Highest-Risk KEV Vulnerabilities — Supersedes BOD 22-01, Cites AI-Accelerated Exploitation

CISA issued Binding Operational Directive 26-04 on June 10, replacing BOD 19-02 and BOD 22-01 with a risk-matrix framework that scores vulnerabilities across four criteria: internet exposure, KEV status, exploit automatability, and technical impact. Vulnerabilities meeting all four criteria — internet-exposed, KEV-listed, fully automatable, and granting total system control — must be remediated within 72 hours and require mandatory forensic triage to assess prior compromise before patching. CISA explicitly cited AI-assisted exploit automation as a key driver, noting that only 26% of KEV-listed vulnerabilities were fully remediated in 2025 (down from 38% the prior year), with median time to resolution rising to 43 days.

CISA explicitly cited AI-assisted exploit automation as a key driver, noting that only 26% of KEV-listed vulnerabilities were fully remediated in 2025 (down from 38% the prior year), with median time to resolution rising to 43 days.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.