Binding Operational Directive is a mandatory cyber risk management order that the U.S. Cybersecurity and Infrastructure Security Agency issues to federal civilian executive branch agencies, requiring specific security actions, deadlines, and reporting to address defined vulnerabilities and strengthen the security of federal information systems.
116 articles about Binding Operational Directive
Decision Insights Threat Desk • November 26, 2025
CISA added CVE-2025-13223 in Google Chromium V8 to its Known Exploited Vulnerabilities Catalog, urging prompt remediation.
Decision Insights Threat Desk • November 26, 2025
CISA has updated its Known Exploited Vulnerabilities Catalog with three new vulnerabilities under active exploitation, urging organizations to prioritize timely remediation to reduce cyberattack risks. The updates relate to vulnerabilities in WatchGuard Firebox, Gladinet Triofox, and Microsoft Windows.
Decision Insights Threat Desk • November 26, 2025
CISA adds CVE-2025-11371 and CVE-2025-48703 to its catalog citing verified active exploitation vulnerabilities.
Decision Insights Threat Desk • November 25, 2025
CISA has added five vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities Catalog, urging federal agencies and organizations to prioritize remediation to reduce cyberattack exposure.
Decision Insights Threat Desk • November 25, 2025
CISA updates KEV Catalog with two new vulnerabilities affecting Adobe Commerce and Microsoft WSUS after active exploitation evidence.
Decision Insights Threat Desk • November 25, 2025
CISA adds two Dassault Systèmes DELMIA Apriso vulnerabilities to Known Exploited Vulnerabilities Catalog for active exploitation.
Decision Insights Threat Desk • November 25, 2025
CISA adds two vulnerabilities affecting XWiki Platform and Broadcom VMware to its KEV Catalog, with federal agencies required to remediate them.
Decision Insights Threat Desk • November 25, 2025
CISA added CVE-2025-58034, a Fortinet FortiWeb OS command code injection vulnerability, to the Known Exploited Vulnerabilities Catalog with a one-week remediation guideline.
Decision Insights Threat Desk • November 25, 2025
CISA added CVE-2025-58034, a Fortinet FortiWeb OS command code injection vulnerability, to its Known Exploited Vulnerabilities Catalog. This vulnerability is actively exploited, with a recommended remediation timeframe of one week. Federal agencies are required to address such vulnerabilities under BOD 22-01.
Decision Insights Threat Desk • November 24, 2025
CISA added CVE-2025-21042, an out-of-bounds write flaw in Samsung mobile devices, to its Known Exploited Vulnerabilities catalog due to active exploitation.
Decision Insights Threat Desk • November 21, 2025
CISA has added CVE-2025-61757 impacting Oracle Fusion Middleware to the Known Exploited Vulnerabilities Catalog.
Decision Insights Threat Desk • November 21, 2025
CISA adds CVE-2025-61757 affecting Oracle Fusion Middleware to Known Exploited Vulnerabilities Catalog following active exploits.