CISA BOD 26-04 Explained: KEV Deadlines, Forensic Triage and What Private Teams Can Borrow

If you work for a U.S. federal civilian agency, Binding Operational Directive 26-04 (BOD 26-04) sets how fast you must fix known exploited vulnerabilities. If you do not, it still matters, because CISA’s Known Exploited Vulnerabilities (KEV) catalog entries now carry its deadlines and its forensic-triage language, and many private teams use KEV as a patching signal. This article explains what the directive says, what we could and could not verify, and which parts transfer to organizations it does not bind.

We read CISA’s directive page, CISA’s implementation guidance page, the KEV catalog and National Vulnerability Database (NVD) records on October 12, 2026. This is research-based analysis; we did not test any system.

What BOD 26-04 is and who it covers

Source: CISA, BOD 26-04.

The four inputs that set the deadline

Instead of one deadline for every KEV entry, the directive uses a table (Table 1, Appendix A) with four yes/no style decision points, measured in calendar days:

1. KEV status: is the vulnerability in the KEV catalog?
2. Publicly exposed: is the asset reachable by unauthenticated or untrusted parties over public networks, wherever it physically sits? If several methods are used and any finds the asset exposed, the value is “yes.”
3. Automatable: can exploitation be scripted reliably? CISA’s heuristic: if a public proof-of-concept achieves remote code execution and reliably runs against a vulnerable system, it is automatable. CISA publishes results through its Vulnrichment Program.
4. Technical impact: total if the attacker can run arbitrary software, trigger all actions of the component, get a full-privilege account, or both CVSS confidentiality and integrity impacts are High; otherwise partial. Denial of service generally counts as partial.

The clock starts at whichever comes first: CISA adding the CVE to KEV, or the agency identifying the vulnerability on an asset and updating its Continuous Diagnostics and Mitigation (CDM) dashboard. Timelines are dynamic: removing an asset from public exposure can lengthen its deadline, and a KEV addition shortens it.

What the deadlines actually are

This is where we must be careful. CISA’s text states that where the table says “& forensic triage,” the agency must remediate or mitigate within three days and also perform forensic triage. The page also describes “fix on system upgrade” for lower-risk cases. The individual day counts for every row are in an image of Table 1 that our reading tool could not extract, so we have not verified them against CISA’s own table.

For orientation only, Tenable’s secondary summary describes tiers of 3 days with triage, 3 days without triage, 14 days, 60 days and fix-on-upgrade. Treat that as a pointer, and read Appendix A on CISA’s site before relying on a specific number.

Phase dates

The directive phases its requirements. Phase I applies immediately; Phase II within 60 days of issuance; Phase III within 180 days.

The dates in the last column are our arithmetic from the page date. The directive measures from issuance, and we found no separate issuance date, so treat them as approximate. On that count, Phase III had not yet begun as of October 12, 2026.

Case study: five old CVEs added on October 8, 2026

The KEV catalog lists five entries added on 2026-10-08, each with a due date of 2026-10-11. NVD records for each show CISA’s required action referring to BOD 26-04 and its “Forensics Triage Requirements.”

Sources: CISA KEV catalog and the NVD records (CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081, CVE-2015-5477). Scores are those listed in NVD, retrieved October 12, 2026; where two scorers differ, both are shown. The NVD records had been modified on October 9, 2026, so scores may change.

What this shows, and what it does not:

• Age is not safety. These flaws date from 2015 to 2023, yet were added with a three-day due date. The three-day interval is what the catalog and NVD show; we cannot tell from public data which row of Table 1 applies to any agency’s asset, since that depends on exposure.
• CVSS and KEV answer different questions. The Strapi entry has an NVD base score of 4.9 yet is in KEV. Our guide to CVSS, EPSS and KEV explains why exploitation evidence outranks severity.
• We do not know how or by whom these were exploited. The catalog entries we read do not say, and we have not assumed it.
• Dates differ by product version. If you run any of these products, check your exact version against the NVD affected ranges and your vendor’s fixes; backported distribution patches can change the answer.

Forensic triage: what “three days” includes

CISA’s implementation guidance presents baseline steps as best practice, and says the directive requires an adequate triage but not these specific timings. If a KEV entry has its own triage steps, those take precedence.

The ordering matters: evidence is collected before remediation where possible, because patching can destroy the traces you need.

What non-federal teams can borrow

The directive does not bind you, so these are our suggestions, not requirements.

1. Make exposure a first-class input. Tag assets by environment, exposure and type, as the directive’s Phase III tagging requires, so “is it internet-reachable?” is a query rather than a meeting.
2. Treat KEV as a trigger for compromise checks, not only patching. An exploited flaw that was exposed before you patched may already have been used. Compare with how we handled recent zero-day roundups and the Cisco SD-WAN log checks.
3. Rehearse the 72 hours. Decide who runs scoping, where evidence goes and how you communicate if email is suspect. Our piece on why vulnerability backlogs never shrink covers the process side.
4. Inventory old software. The October 8 batch is a reminder that forgotten FTP daemons, unpatched Struts apps and DNS servers can matter. If you cannot list them, you cannot fix them.
5. Know your response to a zero-day before one lands: see what to do when a zero-day is announced.

Limits of this article

We could not read Table 1 as text and have not verified individual day counts beyond the three-day forensic triage requirement. We did not find a separate issuance date, so the phase dates are approximate. We did not verify whether any of the five products is exploited in a particular environment, nor the exploitation details behind the KEV additions. We did not review agencies’ compliance with the directive.

Sources and verification

Checked on October 12, 2026.

Vulnerability ManagementProcess