Week of June 8, 2026: CISA's BOD 26-04 Directive and New CISO Hires at GitLab, Infoblox

Security leaders faced a dense slate of federal vulnerability action during the week of June 8, 2026, as CISA issued its new risk-based patching directive, Binding Operational Directive 26-04, and added seven actively exploited flaws—including bugs in Oracle PeopleSoft, Ivanti Sentry, and Cisco Catalyst SD-WAN Manager—to its Known Exploited Vulnerabilities Catalog. The week also brought fresh C-suite movement, with GitLab, Infoblox, Nubank, and BreachRx naming new chief information security officers, while CISA closed out its seventh annual President's Cup cybersecurity competition.

CISA Issues Binding Operational Directive 26-04 on Risk-Based Patching

On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," requiring federal civilian agencies to weigh four factors when scheduling patches: asset exposure, Known Exploited Vulnerabilities status, exploit automation, and post-exploitation technical impact. The directive updates and consolidates BOD 19-02 and BOD 22-01, sets a three-day remediation window for the highest-risk flaws, and adds requirements for agencies to check whether a system was compromised before a patch was applied. CISA said it encouraged organizations outside the federal civilian branch to adopt the same risk-based approach. (CISA)

CISA Adds Actively Exploited Oracle PeopleSoft Flaw to KEV Catalog

On June 12, 2026, CISA added CVE-2026-35273, a missing-authentication vulnerability in Oracle PeopleSoft Enterprise PeopleTools, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The addition triggers remediation obligations for federal civilian executive branch agencies under Binding Operational Directive 26-04, which prioritizes vulnerabilities that can grant attackers control of exposed assets. CISA said it continues to urge all organizations, not just federal agencies, to treat KEV Catalog entries as a priority in their patch management programs. (CISA)

Ivanti Sentry Command Injection Bug Joins CISA's KEV List

CISA added CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry, to its Known Exploited Vulnerabilities Catalog on June 11, 2026, citing evidence of active exploitation. The flaw affects a product frequently targeted by threat actors seeking full control of internet-facing systems, making it a priority case under CISA's new risk-based patching directive. Federal civilian agencies must remediate it within the timelines set by Binding Operational Directive 26-04, and CISA again urged private-sector organizations to apply the same urgency to this class of vulnerability. (CISA)

CISA Flags Cisco SD-WAN, Arista EOS, and Chromium V8 Flaws as Exploited

On June 9, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVE-2026-7473 in Arista Extensible Operating System, and CVE-2026-11645 in Google Chromium's V8 engine, each already under active exploitation. The additions touched core network management and browser infrastructure widely deployed across enterprise environments. CISA reiterated that Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog entries by their due dates and encouraged all organizations to fold KEV Catalog vulnerabilities into routine patch management. (CISA)

CISA Adds BerriAI LiteLLM and Check Point Gateway Bugs to KEV Catalog

CISA's first KEV update of the week, released June 8, 2026, added CVE-2026-42271, a command injection flaw in BerriAI LiteLLM, and CVE-2026-50751, an improper authentication vulnerability in Check Point Security Gateway, both already being exploited. The pairing underscored continued targeting of AI-infrastructure tooling alongside traditional network security gateways. CISA pointed agencies to Binding Operational Directive 22-01 for remediation deadlines and asked all organizations to prioritize these entries in ongoing vulnerability management efforts. (CISA)

CISA Names Winners of Seventh Annual President's Cup Cybersecurity Competition

CISA announced the winners of its seventh annual President's Cup cybersecurity competition on June 9, 2026, following Finals held in the Washington, DC area that concluded in late May. More than 800 individuals and 200 teams entered, competing across Defensive, Offensive, and Teams tracks. The Navy's "sheriffsparks" topped the Individuals Defensive Track, the Army's "bdubya" won the Offensive Track, and a joint Army-Marine Corps team, "ENOENTHUSIASM," took the Teams title, highlighting the federal government's ongoing push to identify top in-house cyber talent. (CISA)