CISA defines a new vulnerability prioritization model requiring vulnerabilities with three or more risk characteristics—internet exposure, active exploitation, automatable exploits, or high post-exploitation impact—to be patched within three days, marking a shift away from pure CVSS-based prioritization.