# CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies

> CISA Binding Operational Directive 26-04, 'Prioritizing Security Updates Based on Risk,' issued June 10, 2026, replaces CVSS-driven patch mandates with a four-variable risk model (public exposure, KEV catalog status, exploit automation, technical impact) that formally retires BOD 19-02 and BOD 22-01. It compels Federal Civilian Executive Branch agencies toward tiered remediation timelines (3/14/60 days or deferral), new operational KPIs, and a two-metric board reporting model, with a 180-day (~December 7, 2026) compliance deadline and downstream reach into federal contractors and FedRAMP-certified cloud providers.

- **Published:** 2026-07-06T00:00:00Z
- **Last reviewed:** 2026-07-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1134
- **ID:** TL-2026-1134
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-10520, CVE-2026-10523, CVE-2025-67038, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-12569, CVE-2026-20230

## Description

On June 10, 2026, CISA Acting Director Nick Andersen signed Binding Operational Directive (BOD) 26-04, 'Prioritizing Security Updates Based on Risk,' the most consequential rewrite of federal vulnerability-management policy in years. The directive formally revokes and supersedes BOD 19-02 (Vulnerability Remediation Requirements for Internet-Accessible Systems, April 29, 2019) and BOD 22-01 (Reducing the Significant Risk of Known Exploited Vulnerabilities, November 3, 2021), retiring more than a decade of flat, volume-based 'patch everything on the same clock' doctrine. In its place, BOD 26-04 mandates a four-variable risk model -- (1) public exposure (is the asset reachable via a routable IP), (2) Known Exploited Vulnerabilities (KEV) Catalog membership, (3) exploit automation potential, and (4) technical impact (partial vs. total system control) -- that determines which of several graduated remediation tiers applies to a given vulnerability instance: 3 days with mandatory forensic triage (all four criteria met, the most aggressive standing federal remediation timeline on record), 3 days without forensic triage, 14 days for most other KEV-listed flaws, 60 days for lower-risk combinations, or deferral to the next scheduled system upgrade. Timelines are explicitly dynamic: they shift automatically if an asset's exposure status changes or if CISA adds a CVE to the KEV Catalog. CISA co-authors Chris Butera and Jonathan Spring framed the shift in a companion post titled 'Patch Smarter, Not Harder,' with Butera noting that 'defenders are already struggling to keep up,' citing Verizon's 2026 Data Breach Investigations Report finding that only 26% of KEV Catalog vulnerabilities were fully remediated by organizations in 2025 (down from 38% the prior year), with median full-resolution time rising to 43 days. Tenable's analysis, corroborated by Cyentia Institute research, found organizations can realistically remediate only about 10% of open vulnerabilities per month regardless of size -- reframing the doctrine as 'prioritization, not speed.'

BOD 26-04 is also a deliberate move away from CVSS base scores as a federal prioritization mechanism, replacing them with Stakeholder-Specific Vulnerability Categorization (SSVC). This creates an implementation gap: CISA's Vulnrichment program currently supplies SSVC decision data for only about 45.8% of CVEs (roughly 64,142 CVEs), meaning agencies must manually assess automatability and technical impact for the majority of vulnerabilities. Early federal analysis cited by industry commentary found only about 1% of vulnerability instances land in the 3-day bucket while more than 60% qualify for deferral, illustrating the intended 'patch less, but better' effect. On the reporting side, the directive obsoletes legacy patch-volume/speed metrics in favor of new operational KPIs -- remediation compliance by BOD tier, KEV-listed vulnerability coverage, exposure-surface reduction, forensic-triage completion rate, deferral-justification documentation, and KEV response speed -- and a two-metric board communication model combining monitoring-coverage breadth (a leading indicator of risk visibility) with risk-tier remediation rate (a trailing performance indicator) for CISO-to-executive reporting.

Compliance is staged: agencies had to begin updating vulnerability-management policy immediately (already in effect at issuance), must update common remediation processes and receive CISA's machine-level asset-tagging requirements within 60 days (~August 9, 2026), and must achieve full compliance with the new remediation timelines within 180 days (~December 7, 2026). The directive binds FCEB agencies directly; it does not automatically bind contractors, but it directs agencies to review all contracts, in consultation with the Contracting Officer, to determine what modifications are necessary to flow the requirements down -- extending its practical reach to thousands of federal contractors and systems integrators. In parallel, FedRAMP's 'Vulnerability Detection and Response' rule (part of the FedRAMP 20x Consolidated Rules for 2026, addressed in FedRAMP Notice 0014) becomes mandatory for all cloud service offerings obtaining or maintaining FedRAMP Certification effective the same December 7, 2026 date, explicitly aligning cloud-provider vulnerability-management obligations with BOD 26-04's risk model and ending the legacy monthly-scan baseline.

BOD 26-04 does not exist in isolation: it is one of three interlocking 2026 federal cybersecurity policy actions. CISA BOD 26-02 ('Mitigating Risk From End-of-Support Edge Devices,' issued February 5, 2026) separately compels agencies to inventory, decommission, and continuously monitor unsupported edge devices (firewalls, routers, VPN gateways) on 3/12/18/24-month milestones. OMB Memorandum M-26-14 ('Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats,' issued May 22, 2026, rescinding the SolarWinds-era M-21-31) reframes federal logging around Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response and Forensics (THIRF), with its own maturity deadlines -- and its telemetry requirements are what make BOD 26-04's dynamic, evidence-based deferral-justification model operationally feasible.

The directive's real-world bite was demonstrated almost immediately: on June 10, 2026, Ivanti released patches for CVE-2026-10520, an unauthenticated, root-privilege OS command injection vulnerability in its Sentry (formerly MobileIron Sentry) security gateway appliance, initially stating there was 'no evidence of in-the-wild exploitation.' The Shadowserver Foundation contradicted this within a day, reporting a large volume of exploitation attempts and mass backdooring of internet-exposed Sentry gateways following release of a public proof-of-concept. CISA added CVE-2026-10520 to the KEV Catalog on June 11, 2026, and imposed a hard June 14, 2026 remediation deadline -- the first real-world application of BOD 26-04's most aggressive 3-day/forensic-triage tier, since the flaw was publicly exposed, KEV-listed, trivially automatable, and yielded total (root) system control. CISA continued normal KEV Catalog operational cadence through the rest of June 2026, adding vulnerabilities in Lantronix EDS5000 (code injection), Ubiquiti UniFi OS (improper access control, path traversal, improper input validation, three separate CVEs on June 23), PTC Windchill/FlexPLM (improper input validation) and Cisco Unified Communications Manager (SSRF, both on June 25) -- each addition automatically re-triggering BOD 26-04's dynamic tiering for any FCEB agency running the affected products.

Industry reaction has split along predictable lines: VulnCheck's Patrick Garrity called the shift positive momentum long overdue and consistent with practices some organizations have used for years, while runZero's Tod Beardsley voiced skepticism that 'a three day deadline spread across more than a hundred agencies is an achievable patch cadence today.' Commentary elsewhere (Picus Security's 'CVSS Is Officially Dead,' Chris Hughes's 'The Death of CVSS as Federal Policy') frames BOD 26-04 as a bellwether the private sector will likely follow. Coverage also links the policy's urgency to AI-accelerated vulnerability discovery and weaponization as a stated motivator for compressing federal response timelines. For SOC and vulnerability-management teams, BOD 26-04 is not itself an exploit or malware threat -- there is no CVE, CVSS score, or attributed adversary -- but it is an operationally binding compliance deadline that reshapes patch prioritization, CISO reporting structure, and contractor/cloud-provider security obligations across the federal enterprise, and it retroactively changes which currently-known vulnerabilities (e.g., the Ivanti Sentry, Ubiquiti UniFi OS, and Cisco UCM flaws above) carry hard, dynamically-triggered federal patch deadlines.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1584.004 Server
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1548 Abuse Elevation Control Mechanism
- T1212 Exploitation for Credential Access
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071.001 Web Protocols

## Sources

- [BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities](https://www.cisa.gov/news-events/news/cisa-issues-new-directive-improving-how-federal-agencies-prioritize-mitigation-cyber-vulnerabilities)
- [Patch Smarter, Not Harder](https://www.cisa.gov/news-events/news/patch-smarter-not-harder)
- [BOD 26-02: Mitigating Risk From End-of-Support Edge Devices](https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [BOD 26-04: CISO Reporting & Risk Metrics](https://www.tenable.com/blog/bod-26-04-ciso-reporting-risk-metrics)
- [What is CISA BOD 26-04: Impact on vulnerability remediation](https://www.tenable.com/blog/cisa-bod-26-04-FAQ-vulnerability-remediation-impact)
- [CVSS Is Officially Dead: What CISA's BOD 26-04 Means for Everyone](https://www.picussecurity.com/resource/blog/cvss-is-officially-dead-what-cisas-bod-26-04-means-for-everyone)
- [The Death of CVSS as Federal Policy](https://www.resilientcyber.io/p/the-death-of-cvss-as-federal-policy)
- [What is CISA BOD 26-04? Prioritizing Security Updates Based on Risk](https://nucleussec.com/resources/knowledge-center/what-is-cisa-bod-26-04/)
- [Helping Federal Agencies Meet CISA's Accelerated Remediation Timelines outlined in CISA BOD 26-04](https://www.vulncheck.com/blog/cisa-bod-26-04)
- [FedRAMP Response to CISA BOD 26-04 (Prioritizing Security Updates Based on Risk)](https://www.fedramp.gov/notices/0014/)
- [Vulnerability Detection and Response - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1134