On June 10, 2026, CISA issued Binding Operational Directive 26-04, establishing a dynamic vulnerability prioritization model that requires critical flaws to be remediated within three days.
What BOD 26-04 Changed
On June 10, 2026, CISA issued Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk. The directive supersedes and revokes two prior directives, BOD 19-02 and BOD 22-01.
While BOD 19-02 prioritized internet-facing vulnerabilities by static CVSS score and BOD 22-01 applied a flat 14-day deadline to every entry on the Known Exploited Vulnerabilities Catalog, the new directive introduces a dynamic model based on four core variables.
The Four Variables and Remediation Tiers
BOD 26-04 evaluates every vulnerability against asset exposure, KEV status, exploit automation, and technical impact. These four variables combine into a graduated timeline ranging from a three-day window for Tier 1 and Tier 2 vulnerabilities to 14, 60, or deferred timelines for lower-risk tiers.
According to Rapid7, asset exposure is the highest-leverage variable because removing an asset from public reach flips exposure from yes to no and relaxes the required timeline.
The Forensic Triage Mandate
For Tier 1 vulnerabilities involving KEV listing and total control, organizations must patch within three days and run a concurrent forensic investigation to determine if the asset was already compromised. Rapid7 notes that tools like Velociraptor can help organizations capture volatile memory and hunt indicators of compromise across endpoints without delaying remediation.
What to do
- Establish continuous external-plus-internal asset visibility to track asset exposure.
- Automate and continuously ingest the KEV Catalog to track active threats.
- Pre-stage forensics to capture volatile evidence across endpoints within 72 hours.
Key facts and where they come from
- CISA issued Binding Operational Directive 26-04 on June 10, 2026.
On June 10, 2026, CISA issued Binding Operational Directive 26-04,
- Tier 1 vulnerabilities require a three-day remediation window and a concurrent forensic investigation.
For Tier 1 vulnerabilities (KEV + Total control), you must not only patch within three days, but run a concurrent forensic investigation
- BOD 26-04 supersedes and revokes BOD 19-02 and BOD 22-01.
BOD 26-04 supersedes and revokes two prior directives: BOD 19-02 (2019)
- The 2026 Verizon Data Breach Investigations Report states the median full-remediation time is 43 days.
The 2026 Verizon Data Breach Investigations Report puts the industry's median full-remediation time at 43 days
