Security updates fix flaws that criminals can use, and the rules for deciding which flaws to fix first changed in 2026. This article explains how vulnerabilities are tracked, how a federal directive ranks them, and what that means for people who just want their devices to be safe.
What a security patch actually does
Software is written by people, and it contains mistakes. Some mistakes are harmless bugs. Others are vulnerabilities: flaws that let someone run code, read data or take control of a device without permission. A patch is a change from the vendor that corrects the flaw, and an update is the package that delivers it, often together with other fixes.
The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency that coordinates civilian cyber defense, puts the consumer version plainly in its public guidance. Many updates fix security risks, so tapping “Remind me later” can leave a device exposed. CISA advises installing updates for operating systems, programs and apps, especially web browsers and antivirus software, and installing critical ones promptly because criminals act quickly. It also advises turning on automatic updates so devices install fixes as soon as they are available.
Updates also fix ordinary bugs, improve performance and add features, according to the same guidance. The security benefit, however, is the reason delay carries a cost.
Why do attackers target old flaws?
Once a vendor ships a patch, the flaw is no longer secret. The fix itself shows what was wrong, and attackers can study it. Devices that have not yet installed the update stay vulnerable, which is why a known, patched flaw can remain useful to criminals long after the fix is released.
CISA’s illustration is a composite example, not a news case: a person who routinely dismissed update prompts picked up malware from an infected website that exploited a known flaw in an outdated operating system. A repair shop removed the malware, updated the system and switched on automatic updates. The pattern is the one that matters. The attack did not need a clever new trick, only an unpatched machine.
How flaws get names and scores
Security teams need a shared way to refer to a flaw. The system is built from a few pieces.
| Term | What it is |
|---|---|
| CVE | A “Common Vulnerabilities and Exposures” identifier, a catalog number assigned to a specific publicly disclosed flaw |
| NVD | The National Vulnerability Database, run by the National Institute of Standards and Technology (NIST), which adds details to CVEs |
| CVSS | The Common Vulnerability Scoring System, a numerical severity score |
| KEV | CISA’s Known Exploited Vulnerabilities catalog, a list of flaws with evidence of real-world attacks |
According to NIST, the NVD is a repository of information on software and hardware flaws that can compromise computer security. It adds details such as severity scores and affected-product lists so professionals can prioritize. The NVD has always provided CVSS scores, and NIST says it began adding a second kind of data, Stakeholder-Specific Vulnerability Categorization (SSVC), from CISA-authorized publishers on June 17, 2026.
A volume problem
The number of flaws is large and rising. NIST says CVE submissions grew 263% from 2020 to 2025 and that it enriched nearly 42,000 CVEs in 2025, 45% more than in any earlier year. Since April 15, 2026, NIST says, it enriches only CVEs that meet certain criteria, such as those in CISA’s KEV catalog, those in software used by the federal government and those in critical software defined under Executive Order 14028. Other CVEs remain listed but are labeled “Lowest Priority.”
NIST also reported that in April 2026 it found about 4,500 CVEs, 19% of those with a CVSS version 4.0 score, had numerical scores that were too high, and fewer than 30 were too low. It scheduled a correction script. The episode is a reminder that a severity score is an estimate, not a measurement.
What is the Known Exploited Vulnerabilities catalog?
Most flaws are never used in an attack. The KEV catalog separates those that are. CISA calls it the authoritative source of vulnerabilities that have been exploited in the wild, meaning used in real attacks and not merely demonstrated in a lab.
Under the original 2021 directive, a flaw was added if it met three conditions, according to CISA’s archived text: it has a CVE identifier, there is clear remediation guidance such as a vendor update, and there is reliable evidence of active exploitation. As of the catalog page viewed for this article, CISA listed 1,773 entries, with additions dated from October 20 to November 9, 2026. The catalog also lets the public nominate a flaw through a form.
For a household or small business, the practical value is that the KEV list is a short, evidence-based signal: if a product you use appears there, attackers are using the flaw now.
How did the federal rules change in 2026?
CISA issued Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk,” on June 10, 2026. A binding operational directive is a compulsory instruction to federal civilian agencies. According to CISA, the new directive consolidates and updates two earlier ones, BOD 19-02 and BOD 22-01, and the earlier 22-01 text is now archived as revoked.
The 2021 version applied fairly simple deadlines: for catalog flaws with CVE identifiers assigned before 2021, six months, and for all others, two weeks, with CISA able to adjust them. The 2026 directive replaces that approach with four questions:
- Asset exposure: is the vulnerable system reachable from the public internet?
- KEV status: is the flaw on the known-exploited list?
- Exploit automation: can an attacker automate every step needed to exploit it?
- Technical impact: does exploitation give partial or total control of the system?
CISA’s stated aim is to focus patching on the highest-risk flaws, with clearer timelines. The directive says the clock starts when CISA adds a flaw to the catalog or when the agency identifies it on one of its assets, whichever is earlier. The full table of day counts is published in the directive; this article does not reproduce it.
Acting CISA Director Nick Andersen said, in the agency’s announcement, that the directive lets agencies concentrate on the highest-risk areas and defer lower-priority patching. CISA also says the change responds partly to agency feedback and to the risk that artificial intelligence tools could shorten the time defenders have to react. That is CISA’s characterization; the announcement does not offer independent measurement of it.
Is installing the patch enough?
Not always. CISA says applying a patch generally does not remove an intruder who got in earlier. For the most urgent cases, the directive requires agencies to remediate or mitigate within three days and also perform forensic triage, an initial examination to judge whether the system was already compromised.
The lesson carries over to individuals and small organizations in a modest way. If a device was exposed to a flaw that was being exploited, updating closes the door, but it does not tell you whether someone has already been inside. Unusual account activity, unexpected logins or a breach notice are signals to act on. The steps in what to do after a data breach cover credential changes and credit protections, and two-factor authentication and passkeys can limit the damage if a password was stolen.
The directive itself binds only federal civilian agencies. It does not apply to national security systems, and contractors are generally covered only if a contract says so. CISA nonetheless strongly encourages private and other non-federal organizations to adopt similar practices.
What does this mean for everyday users?
The directive is written for agencies with thousands of systems, but several of its ideas translate.
- Turn on automatic updates. CISA’s consumer guidance says products should have automatic updates on by default, and if one lacks the option, users can ask the provider why.
- Prioritize exposed and in-use software. Browsers, phones, routers and anything reachable from the internet matter most, mirroring the directive’s exposure criterion.
- Do not postpone critical updates. The same logic that gives agencies short deadlines for exploited flaws applies at home.
- Treat update prompts with care. Fake update pop-ups are a common lure. Install updates from the device’s own settings, not from a link in a message. The techniques in how phishing works and how to spot it apply here too.
Limits remain. Patching depends on vendors still supporting the product, and automatic updates do not exist for every device. A severity score or KEV entry is a signal about risk, not a guarantee about any one system.
Patching as routine maintenance
Security patching is closer to maintenance than to emergency response. The tracking system is imperfect, severity scores get corrected and volumes keep climbing, which is why agencies now sort flaws by exposure, evidence of attack, automation and impact. For individuals, the sorting is simpler: keep software current, let updates install automatically, and watch for signs that something got through before the fix arrived.
This article provides general information about cybersecurity and is not individualized technical, legal or professional advice.
Sources: Cybersecurity and Infrastructure Security Agency; National Institute of Standards and Technology
