Oracle Audit Scripts, CISA issues landmark BOD 26-04 requiring 3-day patch window for highest-risk CVEs.