CISA released Binding Operational Directive (BOD) 26-04 to shift federal vulnerability management from CVSS-only rules toward exposure- and threat-informed prioritization, prioritizing unauthenticated, Internet-exposed vulnerabilities and freeing time for monitoring, identity and resiliency work.