VULNpocalypse
InformationalEcosystem changeOngoing

CISA BOD 26-04 replaces BOD 22-01: three-day deadlines and forensic triage for the riskiest KEV entries

CISA’s BOD 26-04 sets patch deadlines by exposure, KEV status, automation and impact; the riskiest get 3 days. Track KEV dueDate and forensicTriage.

Published
Updated
Exploitation
Not applicable

What happened

On 10 June 2026, CISA issued Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk.” It “supersedes and hereby revokes” BOD 19-02 (2019) and BOD 22-01 (2021), the directive that created the Known Exploited Vulnerabilities (KEV) catalog (CISA BOD 26-04).

Deadlines now depend on four inputs (CISA BOD 26-04; CISA implementation guidance):

  • Publicly exposed: can unauthenticated or untrusted parties reach the asset over the internet?
  • KEV status: is the CVE in the KEV catalog?
  • Automatable: does public exploit code reliably get remote code execution? CISA publishes this through its Vulnrichment programme.
  • Technical impact: “partial” or “total” control. Bugs that leak credentials count as total.

The guidance gives one example: a publicly exposed asset, a KEV entry, total impact and an automatable exploit gets a 3-day deadline. The full timeline table is published as an image in the directive. Some combinations are “fix on system upgrade,” meaning the next scheduled upgrade or rebuild. Taking an asset off the internet can lengthen its deadline. CVSS labels “do not prescribe specific actions” any more (CISA implementation guidance).

Forensic triage before patching. For entries that require it, agencies must check for compromise within the three-day window. The guidance sets target times: scope the incident in 2 hours, preserve evidence before patching (2 to 24 hours), then contain, analyse for persistence and data theft, and decide on escalation by 72 hours. Confirmed compromises go to CISA’s incident reporting system (CISA implementation guidance).

The phases: policy changes took effect immediately, process updates within 60 days, and remediation against the new table, asset tagging and internal IP reporting within 180 days of 10 June (CISA BOD 26-04).

Am I affected?

  • Federal civilian agencies: yes, for any “federal information system,” including third-party hosted ones and cloud services. National security systems and some Department of War and Intelligence Community systems are out of scope (CISA BOD 26-04).
  • Federal contractors: not directly, “unless the procurement contract directs otherwise.” Agencies must review contracts with their contracting officers, so expect new clauses. One legal analysis notes that contracts signed before 10 June may carry security promises that no longer match (CISA BOD 26-04; MZLS).
  • Everyone else: not bound, but the KEV feed now carries CISA’s risk call. Every entry has a forensicTriage field, and the requiredAction text points to BOD 26-04 (CISA KEV feed).

List recent KEV entries with a three-day window or a forensic triage flag:

bash
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
  jq -r '.vulnerabilities[]
    | select(.dateAdded >= "2026-06-10")
    | select(.forensicTriage == "Yes")
    | [.cveID, .vendorProject, .product, .dateAdded, .dueDate] | @tsv'

What to do now

  1. Agencies: map each asset’s exposure first. Exposure is the input you control, and it decides whether a KEV entry lands in the three-day bucket. Report public IPs and domains through Cyber Hygiene, and tag assets as the directive requires (CISA BOD 26-04).
  2. Agencies: write the forensic triage runbook before you need it. The order matters: collect evidence, then patch. Patching first can destroy the evidence the triage needs (CISA implementation guidance).
  3. Contractors: check contracts up for renewal for patch timelines and “known vulnerability” language (MZLS).
  4. Everyone: feed the KEV dueDate and forensicTriage fields into your ticketing, rather than only the CVE ID. When forensicTriage is “Yes”, look for compromise as well as patching.

Why this matters

The KEV feed shows the change. From 1 January to 9 June 2026, KEV due dates were spread across 2, 3, 5, 14 and 21 days, with 14 and 21 days most common. Of the 149 entries added from 10 June to 30 October 2026, 119 had a three-day deadline and the other 30 had 14 days. 96 of those 149 were flagged for forensic triage (CISA KEV feed, catalog version 2026.10.30, our count). For an exploited, internet-facing bug, the federal benchmark is now three days, and “patched” is not the same as “clean.”

Sources