BOD 26-04: CISA's Risk-Based Patch Mandate and What Organizations Must Do Now

CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. The directive is a compulsory order to all federal executive branch departments and agencies under 44 U.S.C. § 3553(b)(2). It revokes and supersedes both BOD 22-01 (issued November 2021) and BOD 19-02, while incorporating and expanding upon their core requirements. The practical result is that federal civilian agencies no longer use CVSS scores as the primary basis for vulnerability prioritization. The replacement is a four-variable model derived from the Stakeholder-Specific Vulnerability Categorization (SSVC) methodology.

For non-federal organizations, the directive is not binding, but it sets the standard that auditors, regulators, and supply chain partners will reference. Understanding the mechanics matters whether you're a federal agency or a private-sector entity that contracts with one.

Why CVSS-Based Prioritization Was Retired

BOD 19-02 established remediation timelines based on CVSS severity ratings for internet-accessible systems. A high score meant a short deadline. A lower score meant more time. The problem with this approach is well-documented: CVSS measures theoretical severity in a vacuum. It does not account for whether a vulnerability is being exploited in the wild, whether the affected asset is reachable from the internet, or whether exploitation can be automated at scale.

By revoking BOD 19-02, CISA formally ended the requirement for FCEB agencies to use CVSS as the prioritization mechanism. The replacement framework asks four operational questions about each vulnerability rather than relying on a single numerical score.

The SSVC-Based Four-Variable Model

BOD 26-04 evaluates every vulnerability against four decision points:

• Asset Exposure: Is the vulnerable system publicly accessible from the internet?
• Known Exploited Vulnerability Status: Is the vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog?
• Automatability: Can exploitation be fully automated without manual intervention?
• Technical Impact: Does successful exploitation grant the attacker full control of the affected system?

A vulnerability that meets all four criteria falls into the most urgent remediation tier with a three-day deadline. Fewer criteria produce longer timelines depending on the specific combination of variables. This tiered approach allocates remediation effort based on actual operational risk rather than a static score.

CISA's Vulnrichment Program provides the data that feeds this model. The program enriches CVE records with SSVC decision points, CWE identifiers, and CVSS data, and bundles them directly into CVE records. That enrichment data is automatically included in existing CVE feeds through the Authorized Data Publisher (ADP) container. Organizations consuming standard CVE feeds already receive this data without additional integration work.

Remediation Timelines

The directive establishes remediation tiers based on the four-variable assessment. The highest tier is well-documented:

Note: The High and Standard tier criteria are determined by specific combinations of the four SSVC variables as detailed in the BOD 26-04 implementation guidance. Consult the implementation guidance for the full decision logic and to confirm exact remediation timelines.

The three-day window for the highest tier reflects the speed at which exploitation occurs once proof-of-concept code becomes available. The directive frames known exploited vulnerabilities as a significant attack vector, consistent with CISA's broader messaging about nation-state threats to U.S. critical infrastructure.

Forensic Triage Requirement

BOD 26-04 adds a requirement that goes beyond patching. When a vulnerability hits the highest remediation tier, agencies must perform forensic triage on affected systems to determine whether compromise has already occurred. The implementation guidance establishes specific forensic triage steps for prompt vulnerability response.

Applying a patch remediates the vulnerability but does not address pre-existing compromise. Forensic triage determines whether exploitation occurred before the patch was applied.

Specific Steps Organizations Must Take

The directive and its implementation guidance lay out concrete organizational requirements:

Immediately Upon Issuance

1. Update vulnerability management policies to incorporate processes for ongoing remediation of vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
2. Adopt the SSVC-based prioritization model in place of CVSS-only prioritization. This means configuring vulnerability management tools to ingest and act on SSVC decision-point data from CVE feeds.
3. Establish forensic triage procedures for the highest-tier vulnerabilities. Define who performs triage, what artifacts are collected, and how results are reported.

Within 60 Days

1. Complete additional implementation milestones specified in the BOD 26-04 implementation guidance.
2. Review vendor and contractor agreements. Agencies must review contracts with vendors who support or operate agency information systems to confirm those contractors can support compliance with the directive's timelines. This extends the directive's reach into the contractor and managed-service-provider ecosystem.
3. Validate asset inventory accuracy. The four-variable model requires knowing which assets are internet-exposed. Organizations that lack accurate, current asset inventories cannot correctly apply the exposure variable.

FedRAMP Alignment

1. FedRAMP alignment. FedRAMP will require mandatory adoption of updated Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules on a timeline specified in the implementation guidance. Cloud service providers operating under FedRAMP authorization must comply with these updated rules. Refer to the FedRAMP Response to CISA BOD 26-04 for current deadlines and details.

How This Affects Organizations Outside Federal Government

BOD 26-04 applies directly to Federal Civilian Executive Branch (FCEB) agencies. Private-sector organizations, state and local governments, and critical infrastructure operators are not bound by it. That said, the directive will likely produce second-order effects across several categories of organizations:

Federal contractors and managed service providers. The directive's requirement that agencies review vendor contracts for compliance support means contractors operating federal systems will need to demonstrate they can meet the directive's remediation timelines. Expect contract modifications and new SLA requirements.

FedRAMP-authorized cloud service providers. The FedRAMP VDR and VER rule adoption timeline makes this mandatory for any CSP holding or seeking FedRAMP authorization.

Organizations in critical infrastructure sectors. CISA's framing of known exploited vulnerabilities as a threat to critical infrastructure signals that future guidance for critical infrastructure sectors will likely mirror the SSVC-based approach.

Cyber insurance underwriters. Insurers already reference CISA directives and KEV catalog compliance in policy assessments. We assess that BOD 26-04's framework will likely become a benchmark for evaluating patch management maturity.

Practical Implementation Considerations

The shift from CVSS to SSVC changes the data pipeline for vulnerability management programs. Several operational adjustments are necessary:

Ingest Vulnrichment data. CISA's SSVC enrichment data flows through the ADP container in standard CVE feeds. Verify that your vulnerability management platform parses and displays ADP container data. Some platforms may require configuration changes or updates to surface SSVC decision points alongside traditional CVSS scores. CISA's Vulnrichment data is available on GitHub at https://github.com/cisagov/vulnrichment.

Map asset exposure accurately. The "asset exposure" variable requires knowing which systems are reachable from the internet. This demands current, validated external attack surface data. Organizations using external attack surface management (EASM) tools should cross-reference those findings with internal asset inventories.

Automate tier classification. Manually evaluating four variables for every vulnerability is not scalable. Build or configure automation rules that consume SSVC data points and asset context to assign vulnerabilities to the correct remediation tier.

Establish forensic triage playbooks. The three-day tier requires forensic triage in parallel with patching. Define the scope of triage: log review periods, indicator sweeps, memory analysis thresholds, and escalation criteria for confirmed compromise.

Analysis

BOD 26-04 reflects a deliberate shift in how the federal government thinks about vulnerability risk. The move from CVSS to SSVC acknowledges that a vulnerability's score tells you very little about whether it will actually be used against your organization. The four-variable model forces a more operationally relevant assessment.

The three-day remediation timeline for the highest tier is aggressive but not arbitrary. It targets a specific category: internet-facing, KEV-listed, automatable, full-impact vulnerabilities. That combination describes the exact scenario where delay results in compromise.

The forensic triage requirement is a meaningful addition. Most vulnerability management programs treat patching as the end state. BOD 26-04 treats it as a necessary but insufficient step, acknowledging that exploitation often precedes patch deployment.

The contractor review requirement is worth close attention. Federal agencies rely heavily on managed service providers, cloud service providers, and system integrators. Pushing compliance obligations into vendor contracts creates accountability across the entire operational chain.

Hunt Guide: BOD 26-04 Compliance Validation — Vulnerability Exposure and Exploitation Risk Assessment

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If our environment contains internet-exposed assets with unpatched KEV-listed vulnerabilities that are automatable and provide full technical impact, we expect to observe unpatched critical systems in vulnerability scan data, evidence of exploitation attempts against exposed services in network/endpoint telemetry, and gaps in asset inventory coverage that prevent correct SSVC tier classification.

Intelligence Summary: CISA issued Binding Operational Directive 26-04 on June 10, 2026, replacing CVSS-based vulnerability prioritization with an SSVC-derived four-variable model that evaluates asset exposure, KEV catalog status, exploitation automatability, and technical impact. The directive mandates 3-day remediation for the highest-tier vulnerabilities (internet-exposed, KEV-listed, automatable, full-impact) and requires forensic triage on affected systems to determine whether compromise occurred before patching. While binding only on FCEB agencies, the framework sets the standard for federal contractors, FedRAMP CSPs, and critical infrastructure sectors including healthcare/DoD.

Confidence: Moderate | Priority: High

Scope

• Networks: All internet-facing DMZ segments, cloud-hosted services (AWS/Azure/Oracle), FedRAMP-authorized environments, and internal systems with direct or NAT-translated internet exposure. Include contractor-managed and MSP-operated systems per BOD 26-04 vendor review requirements.
• Timeframe: Retroactive 90-day lookback to cover the maximum remediation timeline (60 days for standard tier plus buffer for delayed patching), with ongoing monitoring cadence aligned to 3-day, 14-day, and 60-day remediation tiers.
• Priority Systems: Internet-facing web applications, VPN concentrators, email gateways, remote access infrastructure, healthcare information systems (EHR/clinical systems), FedRAMP-authorized cloud workloads, and any systems identified as hosting KEV-listed vulnerabilities in recent scan data.

MITRE ATT&CK Techniques

T1190 — Exploit Public-Facing Application (Initial Access) [P2]

BOD 26-04's highest remediation tier specifically targets internet-exposed systems with KEV-listed, automatable vulnerabilities yielding full technical impact. This hunt validates whether internet-facing assets have unpatched KEV vulnerabilities and detects exploitation attempts against them.

Splunk SPL:

index=corelight sourcetype=corelight_http 
| eval status_code=status_code 
| where status_code>=400 
| stats count dc(id.orig_h) as unique_sources values(uri) as uris by id.resp_h id.resp_p 
| where count > 50 AND unique_sources > 5 
| sort -count 
| table id.resp_h id.resp_p count unique_sources uris 
| rename id.resp_h as dest_ip, id.resp_p as dest_port 
| head 50

Elastic KQL:

event.dataset:"corelight.http" AND http.response.status_code >= 400 AND NOT http.response.status_code:404

Sigma Rule:

title: High Volume HTTP Error Responses to Internet-Facing Service
id: f8a3c2d1-9e4b-4a7f-b5c6-2d1e8f7a3b9c
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects high volume of HTTP error responses on internet-facing services that may indicate exploitation scanning or active exploitation attempts against KEV-listed vulnerabilities per BOD 26-04 risk framework.
logsource:
    category: webserver
    service: access
detection:
    selection:
        sc-status|gte: 400
    filter:
        sc-status: 404
    condition: selection and not filter
    timeframe: 5m
    count: 50
falsepositives:
    - Legitimate web crawlers
    - Misconfigured applications
    - Penetration testing
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Tune threshold values based on baseline traffic volume. Correlate with vulnerability scan data to identify which destination IPs have known unpatched KEV vulnerabilities. High false positive rate from web crawlers — filter known scanner user agents.

T1595.002 — Vulnerability Scanning (Reconnaissance) [P3]

BOD 26-04 highlights that automatable exploitation is a key risk variable. Adversary reconnaissance scanning against internet-exposed assets precedes exploitation. Detecting scanning activity against assets with known KEV vulnerabilities provides early warning.

Splunk SPL:

index=firewall-pan sourcetype="pan:threat" 
| where action="alert" OR action="drop" OR action="reset-both" 
| stats count dc(dest_port) as unique_ports values(threat_name) as threat_names by src_ip dest_ip 
| where unique_ports > 20 OR count > 100 
| sort -count 
| table src_ip dest_ip count unique_ports threat_names 
| head 50

Elastic KQL:

event.dataset:"pan.threat" AND (event.action:"alert" OR event.action:"drop") AND destination.port:*

Sigma Rule:

title: External Vulnerability Scanning Against Internet-Facing Assets
id: a1b2c3d4-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects potential vulnerability scanning from external sources against internet-facing assets, relevant to BOD 26-04 asset exposure assessment.
logsource:
    category: firewall
detection:
    selection:
        direction: inbound
    condition: selection
    timeframe: 10m
    count: 100
falsepositives:
    - Authorized vulnerability scanners
    - Penetration testing
    - CDN health checks
level: low
tags:
    - attack.reconnaissance
    - attack.t1595.002

Correlate scanner source IPs against known authorized scanning infrastructure. Cross-reference destination IPs with asset inventory to identify which scanned hosts are internet-exposed per the SSVC asset exposure variable.

T1068 — Exploitation for Privilege Escalation (Privilege Escalation) [P2]

BOD 26-04's 'technical impact' variable evaluates whether exploitation grants full control. This hunt detects post-exploitation privilege escalation indicators on systems that may have KEV-listed vulnerabilities, supporting the forensic triage requirement.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 
| eval process_lower=lower(Image) 
| where (like(process_lower, "%whoami%") OR like(process_lower, "%systeminfo%") OR like(process_lower, "%net user%") OR like(process_lower, "%net localgroup%") OR like(process_lower, "%nltest%") OR like(process_lower, "%quser%")) 
| bin _time span=5m 
| stats count dc(Image) as unique_commands values(Image) as commands values(CommandLine) as cmdlines by _time Computer User ParentImage 
| where unique_commands >= 3 
| sort -count 
| table _time Computer User ParentImage unique_commands commands cmdlines

Elastic KQL:

event.code:"1" AND (process.name:("whoami.exe" OR "systeminfo.exe" OR "nltest.exe" OR "quser.exe") OR process.command_line:(*"net user"* OR *"net localgroup"*))

Sigma Rule:

title: Post-Exploitation Discovery Commands Indicating Potential Privilege Escalation
id: b2c3d4e5-6f7a-8b9c-0d1e-f2a3b4c5d6e7
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects clusters of reconnaissance commands that commonly follow exploitation of KEV-listed vulnerabilities providing full technical impact. Supports BOD 26-04 forensic triage requirement.
logsource:
    category: process_creation
    product: windows
detection:
    selection_whoami:
        Image|endswith: '\whoami.exe'
    selection_systeminfo:
        Image|endswith: '\systeminfo.exe'
    selection_net:
        Image|endswith: '\net.exe'
        CommandLine|contains:
            - ' user'
            - ' localgroup'
            - ' group'
    selection_nltest:
        Image|endswith: '\nltest.exe'
    condition: 1 of selection_*
falsepositives:
    - System administrators performing routine checks
    - Legitimate scripts and automation tools
level: medium
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.discovery
    - attack.t1033

This detection supports the BOD 26-04 forensic triage requirement. When these indicators are found on systems with recently patched KEV vulnerabilities, escalate to determine if compromise occurred before patch deployment. Expect false positives from admin tools and monitoring scripts — baseline normal admin activity.

T1018 — Remote System Discovery (Discovery) [P3]

Post-exploitation discovery activity is a key forensic triage indicator under BOD 26-04. Detecting lateral movement reconnaissance on systems that hosted KEV-listed vulnerabilities helps determine if compromise occurred before patching.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1 
| eval cmd_lower=lower(CommandLine) 
| where like(cmd_lower, "%ping -n%") OR like(cmd_lower, "%arp -a%") OR like(cmd_lower, "%nbtstat%") OR like(cmd_lower, "%net view%") OR like(cmd_lower, "%dsquery%") OR like(cmd_lower, "%nslookup%") 
| bin _time span=10m 
| stats count dc(CommandLine) as unique_cmds values(CommandLine) as cmdlines by _time Computer User ParentImage 
| where unique_cmds >= 3 
| sort -count 
| table _time Computer User ParentImage unique_cmds cmdlines

Elastic KQL:

event.code:"1" AND process.command_line:(*"ping -n"* OR *"arp -a"* OR *"nbtstat"* OR *"net view"* OR *"dsquery"* OR *"nslookup"*)

Sigma Rule:

title: Remote System Discovery Burst Indicating Possible Post-Exploitation
id: c3d4e5f6-7a8b-9c0d-1e2f-a3b4c5d6e7f8
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects burst of remote system discovery commands that may indicate post-exploitation activity following exploitation of a KEV-listed vulnerability.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'ping -n'
            - 'arp -a'
            - 'nbtstat'
            - 'net view'
            - 'dsquery'
    condition: selection
falsepositives:
    - Network troubleshooting by administrators
    - Monitoring scripts
level: low
tags:
    - attack.discovery
    - attack.t1018

Focus on systems that recently had KEV-listed vulnerabilities patched. If discovery commands originated before patch application timestamp, this supports a finding of pre-patch compromise per BOD 26-04 forensic triage requirements.

T1078 — Valid Accounts (Persistence) [P2]

Exploitation of KEV-listed vulnerabilities often results in credential theft enabling persistence via valid accounts. Forensic triage should include anomalous authentication review on systems where highest-tier vulnerabilities existed.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4624 Logon_Type=10 
| stats count dc(Source_Network_Address) as unique_sources values(Source_Network_Address) as source_ips by TargetUserName Computer 
| where unique_sources > 3 
| sort -count 
| table TargetUserName Computer count unique_sources source_ips

Elastic KQL:

event.code:"4624" AND winlog.event_data.LogonType:"10" AND source.ip:*

Sigma Rule:

title: Anomalous RDP Logon from Multiple Sources
id: d4e5f6a7-8b9c-0d1e-2f3a-b4c5d6e7f8a9
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects a single account authenticating via RDP from multiple distinct source IPs within a short window, which may indicate credential compromise following exploitation of a KEV-listed vulnerability.
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    condition: selection
    timeframe: 1h
falsepositives:
    - Shared admin accounts used from multiple workstations
    - VPN address pool rotation
level: medium
tags:
    - attack.persistence
    - attack.t1078
    - attack.lateral_movement
    - attack.t1021.001

Cross-reference with systems that had KEV-listed vulnerabilities. Focus on time windows before patch deployment to identify credential theft that may have occurred during the exploitation window. Tune unique_sources threshold based on environment norms.

T1046 — Network Service Discovery (Discovery) [P3]

The BOD 26-04 asset exposure variable requires knowing which systems are internet-reachable. This detection identifies internal scanning that may indicate an attacker mapping the network after exploiting an exposed asset, and also supports validating the accuracy of the asset inventory.

Splunk SPL:

index=corelight sourcetype=corelight_conn 
| where id_orig_h!=id_resp_h 
| stats dc(id.resp_p) as unique_ports dc(id.resp_h) as unique_dests count by id.orig_h 
| where unique_ports > 50 OR unique_dests > 20 
| sort -unique_ports 
| table id.orig_h unique_ports unique_dests count 
| rename id.orig_h as source_ip 
| head 30

Elastic KQL:

event.dataset:"corelight.conn" AND NOT source.ip:destination.ip

Sigma Rule:

title: Internal Network Service Scanning Activity
id: e5f6a7b8-9c0d-1e2f-3a4b-c5d6e7f8a9b0
status: experimental
author: RedSheepSec
date: 2026/06/13
description: Detects hosts scanning large numbers of ports or destinations internally, which may indicate post-exploitation reconnaissance following compromise of an internet-exposed asset with a KEV-listed vulnerability.
logsource:
    category: firewall
detection:
    selection:
        direction: internal
    condition: selection
    timeframe: 10m
    count: 100
falsepositives:
    - Vulnerability scanners
    - Network monitoring tools
    - CMDB discovery agents
level: medium
tags:
    - attack.discovery
    - attack.t1046

Compare scanning source IPs against asset inventory of internet-exposed systems. Internal scanning originating from internet-facing hosts is a high-priority indicator. Whitelist known vulnerability scanners and network management tools.

Data Source Requirements

Recommendations

• Verify vulnerability management platforms (Tenable, Qualys, Rapid7) are parsing SSVC decision-point data from CVE feed ADP containers. Test by pulling a recent KEV entry and confirming Exploitation, Automatability, and Technical Impact fields are populated. Reference CISA's Vulnrichment GitHub repository (https://github.com/cisagov/vulnrichment).
• Conduct a comprehensive audit of external attack surface inventory against the SSVC asset exposure variable. Cross-reference EASM tool results with internal CMDB records and firewall rulesets to identify discrepancies and undocumented internet-exposed systems.
• Build or configure automation rules in vulnerability management platforms that classify vulnerabilities into BOD 26-04 remediation tiers (3-day, 14-day, 60-day) based on the four SSVC variables combined with asset context. Manual tier classification is not scalable.
• Deploy the Appendix B detection queries from this hunt across all Splunk instances, focusing on internet-facing system segments. Tune thresholds using baseline data from the past 30 days.
• Draft and validate forensic triage playbooks for highest-tier (3-day) vulnerabilities. Playbooks must define minimum log review windows, memory capture triggers, indicator sweep scope, and escalation criteria for confirmed compromise per the BOD 26-04 implementation guidance.
• Review contracts with all vendors and managed service providers operating or supporting agency information systems. Confirm SLAs support 3-day, 14-day, and 60-day remediation timelines. Complete this review within the 60-day window specified by the directive.
• Ensure Sysmon deployment and CommandLine logging are active on all internet-facing servers and systems identified as hosting KEV-listed vulnerabilities. Gaps in endpoint telemetry directly undermine forensic triage capability.
• Validate that FedRAMP-authorized cloud service providers are aware of and preparing for mandatory VDR/VER rule adoption per the FedRAMP response to BOD 26-04 (https://www.fedramp.gov/notices/0014/).

Sources

• BOD 26-04: Prioritizing Security Updates Based on Risk — CISA Directive
• BOD 26-04 Implementation Guidance — CISA
• CISA Vulnrichment GitHub Repository
• FedRAMP Response to CISA BOD 26-04