On June 10, 2026, CISA issued directive BOD 26-04, which mandates a new approach to managing security updates. This document replaces previous directives BOD 19-02 and BOD 22-01, effectively ending the use of fixed calendar deadlines for patching vulnerabilities listed in the Known Exploited Vulnerabilities (KEV) catalog for US federal agencies.
The new model determines remediation timelines based on the risk level of specific assets. CISA evaluates four factors: public accessibility of the asset, presence in the KEV catalog, exploit automation potential, and the technical impact of an attack. The framework utilizes the Stakeholder-Specific Vulnerability Categorization (SSVC) system to guide these decisions.
Remediation windows now vary significantly based on risk assessment. In high-priority cases, vulnerabilities must be addressed within three days, including a forensic triage. For lower-risk scenarios, organizations may defer fixes until the next scheduled system update. This shift moves away from the previous flat-deadline policy.
Applying this methodology to AI platforms presents unique challenges due to the complexity of the tech stack. Remediation actions vary by layer: web APIs may require standard patches, ML dependencies might necessitate major framework updates, and GPU runtimes could involve firmware changes. Consequently, identical CVSS scores no longer dictate uniform priority or timelines.
