Threat reportThreat IntelligenceTL-2026-1134
CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies
CISA BOD 26-04 (TL-2026-1134), also tracked as BOD 26-04, is a medium-severity tracked intrusion set, first published 2026-07-06. It has no confirmed attribution, affects U.S. Federal Government Federal Civilian Executive Branch (FCEB), references 8 CVEs (CVE-2026-10520, CVE-2026-10523, CVE-2025-67038), maps to 17 MITRE ATT&CK techniques (T1005, T1046, T1059.004), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1134
- Threat ID
- TL-2026-1134
- Also known as
- BOD 26-04, Prioritizing Security Updates Based on Risk, Patch Smarter, Not Harder
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, federalgovernment, publicsector, cloudserviceproviders, defenseindustrialbase, criticalinfrastructure, technology
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in CISA BOD 26-04
Malware and tooling: Automox, CrowdSec Live Exploit Tracker, Nucleus Security, Tenable One
How CISA BOD 26-04 works
CISA Binding Operational Directive 26-04, 'Prioritizing Security Updates Based on Risk,' issued June 10, 2026, replaces CVSS-driven patch mandates with a four-variable risk model (public exposure, KEV catalog status, exploit automation, technical impact) that formally retires BOD 19-02 and BOD 22-01. It compels Federal Civilian Executive Branch agencies toward tiered remediation timelines (3/14/60 days or deferral), new operational KPIs, and a two-metric board reporting model, with a 180-day (~December 7, 2026) compliance deadline and downstream reach into federal contractors and FedRAMP-certified cloud providers.
On June 10, 2026, CISA Acting Director Nick Andersen signed Binding Operational Directive (BOD) 26-04, 'Prioritizing Security Updates Based on Risk,' the most consequential rewrite of federal vulnerability-management policy in years. The directive formally revokes and supersedes BOD 19-02 (Vulnerability Remediation Requirements for Internet-Accessible Systems, April 29, 2019) and BOD 22-01 (Reducing the Significant Risk of Known Exploited Vulnerabilities, November 3, 2021), retiring more than a decade of flat, volume-based 'patch everything on the same clock' doctrine. In its place, BOD 26-04 mandates a four-variable risk model -- (1) public exposure (is the asset reachable via a routable IP), (2) Known Exploited Vulnerabilities (KEV) Catalog membership, (3) exploit automation potential, and (4) technical impact (partial vs. total system control) -- that determines which of several graduated remediation tiers applies to a given vulnerability instance: 3 days with mandatory forensic triage (all four criteria met, the most aggressive standing federal remediation timeline on record), 3 days without forensic triage, 14 days for most other KEV-listed flaws, 60 days for lower-risk combinations, or deferral to the next scheduled system upgrade. Timelines are explicitly dynamic: they shift automatically if an asset's exposure status changes or if CISA adds a CVE to the KEV Catalog. CISA co-authors Chris Butera and Jonathan Spring framed the shift in a companion post titled 'Patch Smarter, Not Harder,' with Butera noting that 'defenders are already struggling to keep up,' citing Verizon's 2026 Data Breach Investigations Report finding that only 26% of KEV Catalog vulnerabilities were fully remediated by organizations in 2025 (down from 38% the prior year), with median full-resolution time rising to 43 days. Tenable's analysis, corroborated by Cyentia Institute research, found organizations can realistically remediate only about 10% of open vulnerabilities per month regardless of size -- reframing the doctrine as 'prioritization, not speed.'
BOD 26-04 is also a deliberate move away from CVSS base scores as a federal prioritization mechanism, replacing them with Stakeholder-Specific Vulnerability Categorization (SSVC). This creates an implementation gap: CISA's Vulnrichment program currently supplies SSVC decision data for only about 45.8% of CVEs (roughly 64,142 CVEs), meaning agencies must manually assess automatability and technical impact for the majority of vulnerabilities. Early federal analysis cited by industry commentary found only about 1% of vulnerability instances land in the 3-day bucket while more than 60% qualify for deferral, illustrating the intended 'patch less, but better' effect. On the reporting side, the directive obsoletes legacy patch-volume/speed metrics in favor of new operational KPIs -- remediation compliance by BOD tier, KEV-listed vulnerability coverage, exposure-surface reduction, forensic-triage completion rate, deferral-justification documentation, and KEV response speed -- and a two-metric board communication model combining monitoring-coverage breadth (a leading indicator of risk visibility) with risk-tier remediation rate (a trailing performance indicator) for CISO-to-executive reporting.
Compliance is staged: agencies had to begin updating vulnerability-management policy immediately (already in effect at issuance), must update common remediation processes and receive CISA's machine-level asset-tagging requirements within 60 days (~August 9, 2026), and must achieve full compliance with the new remediation timelines within 180 days (~December 7, 2026). The directive binds FCEB agencies directly; it does not automatically bind contractors, but it directs agencies to review all contracts, in consultation with the Contracting Officer, to determine what modifications are necessary to flow the requirements down -- extending its practical reach to thousands of federal contractors and systems integrators. In parallel, FedRAMP's 'Vulnerability Detection and Response' rule (part of the FedRAMP 20x Consolidated Rules for 2026, addressed in FedRAMP Notice 0014) becomes mandatory for all cloud service offerings obtaining or maintaining FedRAMP Certification effective the same December 7, 2026 date, explicitly aligning cloud-provider vulnerability-management obligations with BOD 26-04's risk model and ending the legacy monthly-scan baseline.
BOD 26-04 does not exist in isolation: it is one of three interlocking 2026 federal cybersecurity policy actions. CISA BOD 26-02 ('Mitigating Risk From End-of-Support Edge Devices,' issued February 5, 2026) separately compels agencies to inventory, decommission, and continuously monitor unsupported edge devices (firewalls, routers, VPN gateways) on 3/12/18/24-month milestones. OMB Memorandum M-26-14 ('Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats,' issued May 22, 2026, rescinding the SolarWinds-era M-21-31) reframes federal logging around Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response and Forensics (THIRF), with its own maturity deadlines -- and its telemetry requirements are what make BOD 26-04's dynamic, evidence-based deferral-justification model operationally feasible.
The directive's real-world bite was demonstrated almost immediately: on June 10, 2026, Ivanti released patches for CVE-2026-10520, an unauthenticated, root-privilege OS command injection vulnerability in its Sentry (formerly MobileIron Sentry) security gateway appliance, initially stating there was 'no evidence of in-the-wild exploitation.' The Shadowserver Foundation contradicted this within a day, reporting a large volume of exploitation attempts and mass backdooring of internet-exposed Sentry gateways following release of a public proof-of-concept. CISA added CVE-2026-10520 to the KEV Catalog on June 11, 2026, and imposed a hard June 14, 2026 remediation deadline -- the first real-world application of BOD 26-04's most aggressive 3-day/forensic-triage tier, since the flaw was publicly exposed, KEV-listed, trivially automatable, and yielded total (root) system control. CISA continued normal KEV Catalog operational cadence through the rest of June 2026, adding vulnerabilities in Lantronix EDS5000 (code injection), Ubiquiti UniFi OS (improper access control, path traversal, improper input validation, three separate CVEs on June 23), PTC Windchill/FlexPLM (improper input validation) and Cisco Unified Communications Manager (SSRF, both on June 25) -- each addition automatically re-triggering BOD 26-04's dynamic tiering for any FCEB agency running the affected products.
Industry reaction has split along predictable lines: VulnCheck's Patrick Garrity called the shift positive momentum long overdue and consistent with practices some organizations have used for years, while runZero's Tod Beardsley voiced skepticism that 'a three day deadline spread across more than a hundred agencies is an achievable patch cadence today.' Commentary elsewhere (Picus Security's 'CVSS Is Officially Dead,' Chris Hughes's 'The Death of CVSS as Federal Policy') frames BOD 26-04 as a bellwether the private sector will likely follow. Coverage also links the policy's urgency to AI-accelerated vulnerability discovery and weaponization as a stated motivator for compressing federal response timelines. For SOC and vulnerability-management teams, BOD 26-04 is not itself an exploit or malware threat -- there is no CVE, CVSS score, or attributed adversary -- but it is an operationally binding compliance deadline that reshapes patch prioritization, CISO reporting structure, and contractor/cloud-provider security obligations across the federal enterprise, and it retroactively changes which currently-known vulnerabilities (e.g., the Ivanti Sentry, Ubiquiti UniFi OS, and Cisco UCM flaws above) carry hard, dynamically-triggered federal patch deadlines.
MITRE ATT&CK techniques used in TL-2026-1134
Collection
Discovery
T1046 Network Service Discovery
Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1212 Exploitation for Credential Access
Persistence
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1584.004 Server; T1588.005 Exploits; T1588.006 Vulnerabilities
Reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in CISA BOD 26-04
- U.S. Federal Government — Federal Civilian Executive Branch (FCEB) agency IT systems and vulnerability management programs
Vulnerable versions: all FCEB agencies subject to CISA Binding Operational Directives
Fixed in: N/A - policy/process compliance mandate, not a patchable product - Ivanti — Ivanti Sentry (formerly MobileIron Sentry)
Vulnerable versions: versions affected by CVE-2026-10520 / CVE-2026-10523 prior to the June 10, 2026 patch
Fixed in: vendor patch released June 10, 2026 - Lantronix — EDS5000
Vulnerable versions: versions affected by CVE-2025-67038
Fixed in: vendor patch - Ubiquiti — UniFi OS
Vulnerable versions: versions affected by CVE-2026-34908, CVE-2026-34909, CVE-2026-34910
Fixed in: vendor patch - PTC — Windchill and FlexPLM
Vulnerable versions: versions affected by CVE-2026-12569
Fixed in: vendor patch - Cisco — Unified Communications Manager
Vulnerable versions: versions affected by CVE-2026-20230
Fixed in: vendor patch - FedRAMP-authorized Cloud Service Providers — FedRAMP-certified cloud service offerings
Vulnerable versions: all offerings maintaining FedRAMP Certification
Fixed in: must implement the Vulnerability Detection and Response rule by December 7, 2026
Remediation for CISA BOD 26-04
Patches
- Ivanti Sentry: apply the vendor patch for CVE-2026-10520 / CVE-2026-10523 (released June 10, 2026).
- Lantronix EDS5000: apply the vendor patch for CVE-2025-67038 code injection vulnerability.
- Ubiquiti UniFi OS: apply vendor patches for CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation).
- PTC Windchill and FlexPLM: apply the vendor patch for CVE-2026-12569 improper input validation vulnerability.
- Cisco Unified Communications Manager: apply the vendor patch for CVE-2026-20230 SSRF vulnerability.
Immediate actions
- Update agency vulnerability management policy to reflect BOD 26-04's four-variable risk model (asset exposure, KEV status, exploit automation, technical impact); this requirement was already in effect at directive issuance on June 10, 2026.
- Establish a documented process for ongoing remediation of vulnerabilities added to the CISA KEV Catalog, including the 3-day forensic-triage-plus-patch requirement for vulnerabilities meeting all four risk criteria.
- Immediately assess and patch CVE-2026-10520 and CVE-2026-10523 (Ivanti Sentry unauthenticated root OS command injection) on any FCEB or contractor-operated Ivanti Sentry gateway -- CISA's first enforced 3-day deadline under BOD 26-04, with a June 14, 2026 remediation cutoff.
Workarounds
- Where immediate patching of a KEV-listed vulnerability is infeasible within its assigned BOD 26-04 tier, remove public exposure (place the asset behind VPN/allow-list controls or take it offline) to shift it out of the highest-risk 'publicly exposed' variable while remediation is completed.
- Document and retain an auditable deferral justification for any vulnerability not remediated within its assigned tier -- BOD 26-04 requires evidence-based deferral rationale rather than silent non-compliance.
Longer-term hardening
- Adopt Stakeholder-Specific Vulnerability Categorization (SSVC) in place of CVSS base scores for internal prioritization, using CISA's Vulnrichment dataset (~45.8% CVE coverage) and supplementing with manual SSVC assessment for the remaining CVEs.
- Stand up the operational KPIs BOD 26-04 requires in place of legacy patch-volume metrics: remediation compliance by BOD tier, KEV-listed vulnerability coverage, exposure-surface reduction, forensic-triage completion rate, deferral-justification documentation, and KEV response speed.
- Adopt the two-metric board communication model -- monitoring coverage breadth and risk-tier remediation rate -- for CISO reporting to agency leadership.
- Coordinate remediation-timeline tooling with OMB M-26-14's Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response and Forensics (THIRF) logging requirements, since BOD 26-04's dynamic, evidence-based deferral model depends on timely detection telemetry.
- Review all federal contracts with the Contracting Officer to identify modifications needed to flow BOD 26-04 requirements down to contractors and systems integrators.
CVEs associated with CISA BOD 26-04
CVE-2026-10520, CVE-2026-10523, CVE-2025-67038, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-12569, CVE-2026-20230
Weaknesses (CWE) in CISA BOD 26-04
Timeline of CISA BOD 26-04
- CISA issues BOD 19-02 (Vulnerability Remediation Requirements for Internet-Accessible Systems), later revoked and superseded by BOD 26-04.
- CISA issues BOD 22-01 (Reducing the Significant Risk of Known Exploited Vulnerabilities), establishing the KEV Catalog remediation model later revoked and superseded by BOD 26-04.
- CISA issues BOD 26-02 (Mitigating Risk From End-of-Support Edge Devices), part of the same 2026 federal directive family covering edge device and network appliance risk.
- BOD 26-02 3-month milestone: FCEB agencies must submit inventories of end-of-support edge devices to CISA.
- OMB issues Memorandum M-26-14 (Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats), rescinding the SolarWinds-era M-21-31 and introducing the CEM/THIRF logging framework that underpins BOD 26-04's dynamic, evidence-based remediation model.
- CISA Acting Director Nick Andersen signs BOD 26-04 ('Prioritizing Security Updates Based on Risk'), formally revoking BOD 19-02 and BOD 22-01; CISA officials Chris Butera and Jonathan Spring publish the companion 'Patch Smarter, Not Harder' blog post; Ivanti simultaneously releases patches for CVE-2026-10520/CVE-2026-10523, initially stating no evidence of in-the-wild exploitation.
- CISA adds CVE-2026-10520 (Ivanti Sentry unauthenticated root OS command injection) to the KEV Catalog after the Shadowserver Foundation reports mass exploitation attempts and backdooring of internet-exposed Sentry gateways following public PoC release.
- CISA imposes a hard June 14, 2026 remediation deadline for CVE-2026-10520 -- the first real-world application of BOD 26-04's most aggressive 3-day-with-forensic-triage tier.
- Federal 3-day remediation deadline for Ivanti Sentry CVE-2026-10520 lapses under BOD 26-04's highest-risk tier.
- CISA adds four vulnerabilities to the KEV Catalog: Lantronix EDS5000 (CVE-2025-67038) and three Ubiquiti UniFi OS flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), each automatically re-triggering BOD 26-04 dynamic tiering for affected FCEB systems.
- CISA adds two vulnerabilities to the KEV Catalog: PTC Windchill/FlexPLM (CVE-2026-12569) and Cisco Unified Communications Manager SSRF (CVE-2026-20230).
- Tenable publishes 'BOD 26-04: CISO Reporting & Risk Metrics,' analyzing the directive's new KPI and two-metric board communication model (the source article for this hunt).
- 60-day compliance deadline: FCEB agencies must update common vulnerability remediation processes; CISA is to publish machine-level asset-tagging requirements.
- 180-day full compliance deadline for BOD 26-04 remediation timelines; on the same date, FedRAMP's Vulnerability Detection and Response rule becomes mandatory for all FedRAMP-certified cloud service offerings.
- Anticipated window for first post-compliance-deadline reporting cycle under BOD 26-04's new operational KPIs and two-metric board communication model.
Sources cited for CISA BOD 26-04
- BOD 26-04: Prioritizing Security Updates Based on Risk
- BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk
- CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities
- Patch Smarter, Not Harder
- BOD 26-02: Mitigating Risk From End-of-Support Edge Devices
- CISA Adds Four Known Exploited Vulnerabilities to Catalog
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- BOD 26-04: CISO Reporting & Risk Metrics
- What is CISA BOD 26-04: Impact on vulnerability remediation
- CVSS Is Officially Dead: What CISA's BOD 26-04 Means for Everyone
- The Death of CVSS as Federal Policy
- What is CISA BOD 26-04? Prioritizing Security Updates Based on Risk
- Helping Federal Agencies Meet CISA's Accelerated Remediation Timelines outlined in CISA BOD 26-04
- FedRAMP Response to CISA BOD 26-04 (Prioritizing Security Updates Based on Risk)
- Vulnerability Detection and Response - FedRAMP Consolidated Rules for 2026
Detection coverage for TL-2026-1134
As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1134 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.