Your vulnerability management program just got a new boss. On June 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04. The title is "Prioritizing Security Updates Based on Risk." The effect is straightforward: patch faster, but only on the things that matter most.
BOD 26-04 replaces two earlier directives. BOD 22-01 created the Known Exploited Vulnerabilities (KEV) catalog and gave agencies 14 days to patch. BOD 19-02 focused on internet-accessible systems. This new directive supersedes both.
Here is how the new framework works. Every vulnerability is evaluated against four binary criteria.
First, Asset Exposure: is the vulnerable asset accessible from the public internet? Second, KEV Status: does this CVE appear in CISA's Known Exploited Vulnerabilities catalog? Third, Exploit Automation: can the attack be fully automated — no human steps needed between the attacker and the exploit? Fourth, Post-Exploitation Impact: does a successful exploit give the attacker full system control?
The more criteria a vulnerability checks, the faster you patch. A vulnerability that hits all four carries a three-day remediation deadline. That's the most urgent tier. At the other end, roughly 60% of vulnerabilities can be deferred entirely.
The average federal agency takes 55 days to patch half its critical vulnerabilities. A three-day deadline requires fundamentally different processes, not just faster paperwork.
Days after the directive took effect, CISA added CVE-2026-10520 — a maximum-severity command injection flaw in Ivanti Sentry — to the KEV catalog. The deadline for federal agencies: three days.
The directive applies directly to federal civilian agencies. But for defense contractors and other organizations doing business with the government, consider this a strong signal. BOD 22-01 became a private-sector standard adopted by auditors, cyber insurers, and commercial security teams. BOD 26-04 is likely to follow the same path.
NIST has also proposed a new metric called Likely Exploited Vulnerabilities (LEV) to formalize this approach across the standards landscape. The move away from CVSS-only scoring now carries the weight of a binding federal directive.
What does this mean for your team? Start mapping every asset's internet exposure today. You cannot triage to BOD 26-04 standards if you don't know which systems are reachable from outside your network. Review your patch management tooling to support the four-criteria model. If your current process can't handle a three-day turnaround on critical findings, build the exception path now — before you need it.
Accuracy Review — Post 3
- Confirm BOD directive number is "26-04" and title "Prioritizing Security Updates Based on Risk" — verify against cisa.gov primary source
- Verify the four criteria names: Asset Exposure, KEV Status, Exploit Automation, Post-Exploitation Impact — confirm exact wording from CISA's BOD 26-04 text
- Confirm CVE-2026-10520 (Ivanti Sentry) was the first three-day deadline test case
- Verify "roughly 60% can be deferred" claim against Nextgov/FCW analysis
- Confirm NIST LEV (Likely Exploited Vulnerabilities) metric proposal status — proposed vs. finalized
- Verify BOD 26-04 supersedes both BOD 22-01 and BOD 19-02 per CISA documentation