CISA tells govt agencies to patch critical exploited flaws in 3 days

AI-suggested

Federal Civilian Executive Branch agencies must update their vulnerability management policies and asset inventories to comply with BOD 26-04. They should automate reporting of Known Exploited Vulnerabilities (KEV) status and integrate CVE and KEV data into remediation decision processes within 60 days. Agencies are required to implement the new remediation timelines within 180 days, patching critical vulnerabilities within three days and less urgent ones within two weeks. Continuous monitoring and detailed asset metadata reporting are also mandated. No specific patches are provided by this directive; remediation depends on applying vendor fixes for identified vulnerabilities. Agencies outside the directive's scope are not required to comply.