What BOD 26-04 Changed on June 10, 2026 for CISA's Known Exploited Vulnerabilities Deadlines
CISA's catalog of actively exploited vulnerabilities sets federal patch deadlines. Here is how the timelines changed when BOD 26-04 was issued on June 10, 2026.
The Known Exploited Vulnerabilities (KEV) catalog is a list kept by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities that attackers are known to be using. Federal civilian agencies must fix the flaws it lists on set deadlines, and organizations outside government can subscribe to the same updates.
CISA created the catalog in 2021, alongside a binding directive, BOD 22-01, which has an original release date of November 3, 2021. On June 10, 2026, CISA issued BOD 26-04, titled "Prioritizing Security Updates Based on Risk." The newer directive ties remediation timelines to four risk factors. Sources differ on whether it replaces the older one.
How a Flaw Reaches the Catalog
CISA's bulletin of November 3, 2021, time-stamped 7:00 AM EDT, described BOD 22-01 as setting specific timeframes for federal civilian agencies to remediate vulnerabilities that known adversaries are actively exploiting. CISA created the catalog to support the directive and says it will update the catalog regularly.
Organizations can sign up to be notified when new vulnerabilities are added. The 2021 bulletin says CISA "strongly recommends" that private businesses and industry, and state, local, tribal and territorial governments, prioritize mitigation of the covered vulnerabilities and subscribe to catalog updates.
Under the directive, the listed flaws are ones that federal civilian agencies must remediate on set timeframes. The bulletin's recommendations to other organizations are separate from that requirement.
The Deadlines Under BOD 22-01
SecurityWeek, in a June 11, 2026 report on the newer directive, says BOD 22-01 told agencies to patch KEV entries within set timeframes and to report KEV status. It says agencies that missed those deadlines were not penalized.
Stingrai, in its summary of the directive, gives the default deadlines under BOD 22-01 as six months for vulnerabilities with a CVE identifier assigned before 2021, and two weeks for all others.
CISA's 2021 bulletin points readers to the full BOD 22-01 text and its Fact Sheet for more information. The 2026 directive ties its timelines to the four factors described below, and CISA's bulletin links to separate implementation guidance.
The Four Risk Factors in BOD 26-04
CISA's bulletin of June 10, 2026, time-stamped 11:00 AM EDT, sets a prioritization structure based on four factors: asset exposure, KEV status, exploit automation and post-exploitation technical impact. SecurityWeek defines technical impact as how much control an adversary gains over the affected asset after exploitation. Under the new model, a flaw's deadline depends on exposure, catalog status, automation and technical impact.
Under the directive, agencies must prioritize remediation by risk, including KEV status and asset exposure. They must remediate high-risk vulnerabilities rapidly and defer lower-risk ones, according to CISA's bulletin, and must identify and tag all agency-managed and publicly exposed assets.
Agencies must also keep access to Cyber Hygiene scanning and attest each quarter to their exposed IP addresses and domain names, the bulletin says. In designated scenarios, agencies must check whether an adversary compromised an asset before its patch was applied.
SecurityWeek adds that agencies must review and update their vulnerability management policies, provide copies to CISA on request, monitor KEV updates, and automate KEV status reporting.
How the Timelines Map to Exposure and Automation
The four factors combine into 16 possible cases, and Stingrai's table assigns each one a timeline. The outcomes are 3 days, 14 days, 60 days, or a fix at the next major upgrade or rebuild. SecurityWeek says the timelines rest on each flaw's technical impact.
In Stingrai's table, exposed, catalog-listed flaws that can be automated get 3 days, whether they give partial or total control. Exposed, catalog-listed flaws that give total control get 3 days even when exploitation cannot be automated. The table also sets 3 days for automatable total-control flaws on exposed assets outside the catalog, and for automatable total-control flaws in the catalog on assets that are not exposed. Some of those rows add forensic triage.
SecurityWeek describes the 3-day tier in similar terms: publicly exposed KEV-listed assets where attackers can automate exploitation, and flaws that give total control even without automation. It describes the 14- and 60-day tiers as covering lower-risk weaknesses, meaning those that are not on KEV, cannot be automated and/or do not affect publicly exposed assets.
Stingrai's table sets 14 days for exposed, catalog-listed flaws that cannot be automated and give partial control. It sets the same 14 days for catalog-listed flaws on assets that are not exposed, unless those flaws are automatable and give total control. Exposed flaws outside the catalog get 14 days when they give partial control with automation, or total control without it.
The 60-day tier covers exposed flaws outside the catalog that cannot be automated and give partial control, and flaws outside the catalog on assets that are not exposed when they can be automated. A publicly exposed asset with a flaw outside the catalog, no automation and partial control falls under 60 days.
Flaws that are not exposed, are not in the catalog and cannot be automated are fixed at the next major upgrade or rebuild, whether they give total or partial control. Stingrai reports that CISA's implementation guidance says agencies do not need to prioritize those items.
Whether BOD 22-01 Still Applies, and What Remains Open
The sources do not agree on whether BOD 26-04 replaces the earlier directives. Stingrai reports that it "supersedes and hereby revokes" BOD 19-02 and BOD 22-01. BOD 19-02 covers vulnerability remediation for internet-accessible systems. CISA's bulletin describes the new directive as "harmonizing and improving" both earlier directives and does not say either is revoked. SecurityWeek, citing CISA, says BOD 26-04 "builds on" BOD 22-01.
On scope, Stingrai says BOD 26-04 does not apply to contractors unless the governing procurement contract directs it, and that agencies must still review their contracts to decide what modifications are needed. CISA's bulletin says the directive applies to federal agencies and notes that its approach and tools can also help other organizations.
SecurityWeek reports that the directive's requirements align with OMB Circular A-130, the federal policy on managing federal information resources. It also reports that CISA said it would publish data requirements for machine-level asset tagging, using a standardized schema, within 60 days. CISA will update the KEV catalog as soon as it identifies newly exploited flaws and will give agencies metadata and guidance, SecurityWeek says.
