Binding Operational Directive is a mandatory cyber risk management order that the U.S. Cybersecurity and Infrastructure Security Agency issues to federal civilian executive branch agencies, requiring specific security actions, deadlines, and reporting to address defined vulnerabilities and strengthen the security of federal information systems.
116 articles about Binding Operational Directive
Decision Insights Threat Desk • November 21, 2025
CISA added CVE-2025-64446, a Fortinet FortiWeb path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence. Federal agencies must remediate under BOD 22-01; CISA recommends all organizations prioritize mitigation of listed vulnerabilities in vulnerability management.
Decision Insights Threat Desk • November 21, 2025
CISA added CVE-2025-64446, a Fortinet FortiWeb path traversal vulnerability, to its vulnerability catalog after detecting active exploitation.
Decision Insights Threat Desk • November 19, 2025
CISA has added CVE-2025-13223, a Google Chromium V8 Type Confusion Vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence. Organizations are urged to remediate these vulnerabilities in line with Binding Operational Directive 22-01 to minimize cyberattack risks.
Decision Insights Threat Desk • November 19, 2025
CISA adds three vulnerabilities to its Known Exploited Vulnerabilities Catalog, including risks in WatchGuard Firebox and Microsoft Windows.
Decision Insights Threat Desk • November 19, 2025
CISA adds two vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-11371 and CVE-2025-48703, posing risks to federal networks.
Decision Insights Threat Desk • November 18, 2025
CISA adds CVE-2021-43798, a Grafana Path Traversal Vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence.
Decision Insights Threat Desk • November 18, 2025
CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog, including Microsoft and IGEL flaws. CVE-2025-6264 was removed.
Decision Insights Threat Desk • November 18, 2025
CISA has added a new vulnerability, CVE-2025-54253, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence.
Decision Insights Threat Desk • November 18, 2025
CISA adds CVE-2025-54236 and CVE-2025-59287 to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence.
Decision Insights Threat Desk • November 18, 2025
CISA has added two vulnerabilities, CVE-2025-6204 and CVE-2025-6205, to its Known Exploited Vulnerabilities Catalog due to active exploitation evidence.
Decision Insights Threat Desk • November 18, 2025
CISA has added two vulnerabilities to its KEV Catalog: CVE-2025-24893 for XWiki and CVE-2025-41244 for Broadcom VMware products.
Decision Insights Threat Desk • November 18, 2025
CISA has added CVE-2025-58034 to its Known Exploited Vulnerabilities Catalog amid active exploitation, urging organizations to act.