Loading story…
CISA has ordered U.S. federal civilian agencies to move away from deadline-driven patching based primarily on CVSS scores and adopt a risk-based remediation model under Binding Operational Directive 26-04. The directive ties remediation timelines to factors including public exposure, Known Exploited Vulnerabilities status, exploit automation, and technical impact, and it also requires forensic checks for the highest-risk flaws because patching alone may not remove an existing compromise. The order consolidates earlier directives and gives agencies 180 days to fully align their vulnerability handling processes.
The policy shift comes as NIST seeks public input on a broader overhaul of the National Vulnerability Database to support AI-era vulnerability reporting and machine-consumable security data. NIST said rising disclosure volume, inconsistent data quality, and growing reliance on automation are making static prioritization and manual remediation increasingly inadequate, and it is asking stakeholders how AI should be integrated into reporting, dissemination, transparency, auditability, and remediation workflows. Together, the efforts signal a federal push toward faster, context-aware vulnerability prioritization and response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On June 10, CISA issued Binding Operational Directive 26-04, directing U.S. federal agencies to move from CVSS-led, deadline-driven patching to a risk-based remediation model. The directive uses factors including asset exposure, KEV status, exploit automation, and technical impact, and requires forensic checks for the highest-risk vulnerabilities.
NIST issued a request for information seeking feedback on modernizing the National Vulnerability Database and vulnerability reporting processes for an environment shaped by AI and machine-consumable security data. The agency said current approaches are increasingly inadequate amid higher disclosure volume, inconsistent data quality, and demand for near real-time enrichment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcecyberscoop.com
Open sourceinfosecurity-magazine.com
Open sourcepublic-inspection.federalregister.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA issued **Binding Operational Directive `26-04`** requiring U.S. federal civilian agencies to prioritize vulnerability remediation by risk instead of treating all flaws as equally urgent. The directive tells agencies to rank vulnerabilities using four factors: whether the affected asset is public-facing, whether exploitation can be fully automated, whether compromise could enable full system takeover, and whether there is evidence of active exploitation, including inclusion in CISA’s **Known Exploited Vulnerabilities** catalog. Based on those criteria, agencies now face remediation deadlines ranging from **three days** for the highest-risk cases to **60 days** for lower-priority flaws, while some low-risk issues may be deferred until a planned major system upgrade. CISA said the overhaul is meant to help agencies “patch smarter, not harder” as AI shortens the time between disclosure and weaponization and defenders struggle with limited resources. Agencies must immediately update vulnerability management policies, revise remediation processes within 60 days, and fully implement the directive’s timelines within 180 days; vulnerabilities meeting all four criteria also require forensic triage to determine whether systems were already compromised before patching. CISA said an initial review at one large civilian agency found only about **1%** of vulnerability instances would require the three-day response, while more than **60%** could be deferred, and the agency urged private-sector organizations to adopt similar risk-based practices alongside hardening, segmentation, and phishing-resistant MFA.
Jul 13, 2026
NIST has issued a Request for Information seeking public input on modernizing the National Vulnerability Database to better support an AI-shaped cybersecurity environment. The agency said traditional vulnerability management built around periodic scanning, static prioritization and manual remediation is no longer sufficient as disclosed vulnerabilities grow in volume and complexity, technology cycles accelerate, and machine-consumable security data becomes more important. The Federal Register notice includes 30 questions and asks stakeholders to weigh in on improving the NVD’s scalability, interoperability, transparency, automation and near-real-time usefulness. The agency is specifically asking how artificial intelligence could improve vulnerability documentation, risk assessment, remediation and the broader vulnerability management lifecycle, while also addressing risks from AI-assisted vulnerability discovery and exploitation. NIST is also evaluating whether changes to organizational structures, standards and handling procedures are needed to improve data quality and operations, and said the effort is not a response to recent executive orders or the federal **Gold Eagle** initiative. Public comments will be accepted through October 13.
Aug 15, 2026
Security teams are increasingly de-emphasizing *CVSS-only* approaches in favor of prioritizing **known exploited vulnerabilities (KEV)**, driven by evidence that only a small fraction of disclosed CVEs are exploited in the wild. Reporting citing VulnCheck research highlighted that roughly **1% of 40,000+** vulnerabilities disclosed in the prior year saw in-the-wild exploitation, with **network edge devices** disproportionately targeted (reported as **28%** of KEV-impacted products) and recurring exposure across major enterprise stacks including **Microsoft, VMware, Oracle, Ivanti, SonicWall, and Fortinet**. The same research pointed to high-profile exploitation waves such as **SharePoint zero-days** impacting **400+ organizations** and rapid weaponization dynamics like **React2Shell**, which reportedly accumulated **236 public exploits** within a month. In the UK public sector, the Department for Science, Innovation and Technology (DSIT) reported operational improvements from a centralized **Vulnerability Monitoring Service** that continuously scans internet-facing systems across roughly **6,000 organizations** and drives remediation of about **400 confirmed vulnerabilities per month**. DSIT said median remediation time for critical domain-related weaknesses fell to **eight days** (from ~50), other vulnerabilities to **32 days** (from 53), and the backlog of unresolved critical flaws dropped by about **three-quarters**—positioning automated discovery and faster patch cycles as a practical response to long-standing government security shortfalls, even as officials did not quantify exploitation rates or overall compromise trends.
Jun 29, 2026