CISA’s Binding Operational Directive BOD 26-04 formally ends CVSS scores as the primary vulnerability prioritization standard for U.S. federal civilian agencies, replacing them with a risk-based framework that weights active exploitation, real-world exposure, and asset criticality. All FCEB agencies must now align remediation timelines to this model, consistent with the KEV catalog’s established philosophy. Private-sector organizations should treat this directive as a leading indicator: vendor prioritization guidance, cyber insurance requirements, and audit frameworks are likely to shift toward the same risk-based methodology.