# CISA tells govt agencies to patch critical exploited flaws in 3 days

> **Open Intelligence Dossier** · First detected: 2026-06-11 17:26 UTC · Category: Business

## Executive Summary
US government agencies now face a 72-hour deadline to patch critical AI-exploited vulnerabilities—marking a shift in cybersecurity urgency.

## Intelligence Brief
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive requiring federal agencies to patch critical vulnerabilities within **three days** if they are actively exploited. The new policy, outlined in Binding Operational Directive (BOD) 26-04, introduces a risk-based approach to prioritize remediation efforts, reflecting escalating threats tied to AI-driven attacks. Coverage highlights the directive’s immediate impact on federal cybersecurity protocols, with outlets like *Reuters* and *Cybersecurity Dive* framing it as a response to evolving AI threat landscapes.


CISA’s official announcement emphasizes that agencies must now align patching timelines with the severity of risks, rather than adhering to broader, less urgent timelines. Technical publications such as *Dark Reading* and *BleepingComputer* note the directive’s departure from previous patching guidelines, which often allowed longer windows for remediation. Watch for agency compliance reports and potential industry-wide adoption of similar timelines, as private sector entities may follow suit to mitigate AI-facilitated cyber risks.


Updates from CISA on enforcement mechanisms or exceptions for high-complexity patches could also emerge in the coming days.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Dark Reading | CISA Rewrites Federal Patching Requirements for AI Threat Era | [Source Link](https://news.google.com/rss/articles/CBMinAFBVV95cUxQaE56S0JNc0NsVHJ4MExfLTRPcWs4OVJoODl3RHFMdnRSQTlRV1dXaFNnOUtXSFBpSGJmRV92Vm5ycTlNenZYN2hCRGRpdEp5TlV4TkszUTA0akE4NGxKYTBOdlRrVlRzNlI0RHBzZ1RRWFpvTDlnZmgtQjlueC1wRU1MbFNVcVlzMWs0cHM5SnNCNDQ5M2hzbG1zWGE?oc=5) |
| Cybersecurity Dive | CISA gives agencies new vulnerability remediation deadlines that take risk levels into account | [Source Link](https://news.google.com/rss/articles/CBMipAFBVV95cUxQUm9OV3AzZmRIdFU2T2NkREE4ZGlob05NT0w3V3B0MFlSYldHWTdvWTJBS2F0SEp3TFZzaDVDZldTVE54NmRORllzQnZLVk9UUzNJeXhNMDNXdGgtUVF1cDRfVzRyWkRXMDlCNnBEUEZCV0JGSGN6UmF0WUQzZnZ1QzhtaTBWQWVYWFpkOTBYZnk0eFNTd1FzLWRPbm5HTlAtLUk0RQ?oc=5) |
| CyberScoop | CISA directive orders agencies to prioritize vulnerability patching in a new way | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE5uREdDQ2JrU0tza3FKcHZnWFVWd1czcmVWZWJFU0hxYml2NDB5a2dVbjUxUFdKbG40OHRnMmFOVTFaRWp6cXp2cVZLMXRNS1NTNm83WEtCMFpPRDVQdlRqdXlFemdobUxHd196RUFpc0NHN2I3TVB4SXlRWWpINzA?oc=5) |
| Reuters | US shortens cyber fix window to three days as AI threats rise | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxOYUJ0Y3ZPOE9IbWdjS0xqd20zczBOanREM3JhNmk5bVpDYlhkbFlhMTBwTWkxZ080TTEwcHJKVnhocTU3UTdBTGVmQUhrUDhqbE40bGpqS0tpQWI1RmNUMVhNTF9Kb09OYkZIanduaEN5ek1PUkdyZVRJOWxORW9fWFI4Q1Y0OWxYMk9XelRpWmJDVURweXBLT19ORl9RaWh2eWcyVkhmcGNqZ0tn?oc=5) |
| CISA (.gov) | BOD 26-04: Prioritizing Security Updates Based on Risk | [Source Link](https://news.google.com/rss/articles/CBMimgFBVV95cUxPTHhha0dLbWU2aTlDSXFXMGtCaWZNY09UTU5ISWZTOXNLY0xXTnJDSzNMQndTZElSWHFGb2xSNVZxV0Z1QV85Q2xWUU00NkVDelhuM0Zmb19tVVVLNWhpN0QtUmNwMXdMZUNONUNYc0JrbzQ1SkFTR056WWNnOEMtNGhDbExQekxiaWsyQzJUUHR0TFpUdUh2Yzd3?oc=5) |
| BleepingComputer | CISA tells govt agencies to patch critical exploited flaws in 3 days | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxPaUxtbnZTdTE4eWZBV2xaOEFHRzZwLWFIYWVUQTZucU8tUXZwb2wtRE9ndnBaYldpck1OY1ZvZ1FqSHpWaXMzQ2ZJX0hjaWFiemJPTnpQWTNibkhXcHhyQTU3M3lDb1QwQzlHbmVCV2gzUWo2ak1wREU1TkZPN1A5aEFZMm9mZVZ1dVZPSUR3TnJrVXJMWng5aXhFWm5qTUZqYkF2REVVRXUySmFiel8zU1BJVUN6bjTSAbwBQVVfeXFMT1JNMW5mY0lNOWFxVlN4dnZSU0xzVWhhNGVVVjRLdjZ2VDRvYjRPUUNYRHRjSi1zR0I5NjdJM1BYc0hmaklGNWY4NWVoQUdGNHNYZ3ZDLTZXZHdGa3ZmMFlKRTZGTm55Vy1NVFUtLTBTM3ZxMktDNWR1ZDRzc1ZtU3FCdDA0SDZIYmE0VGFJTloxS0E4cGVNREVjRUJ) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-06-11/cisa-tells-govt-agencies-to-patch-critical-exploited-flaws-in-3-days*