CISA's new rule: patch by real risk, not CVE severity scores
CISA's Binding Operational Directive 26-04 forces federal agencies to triage vulnerabilities on four risk factors: exposure, known-exploited status, exploit automation, and technical impact. A publicly exposed, KEV-listed, automatable flaw can demand remediation in three days plus forensic triage; low-risk bugs wait for the next upgrade. Static CVSS scores are out. Any team feeding into government pipelines should rebuild its prioritization around these variables now.