Explainer

BOD 26-04: patch the flaws attackers already use, first

Short answer: CISA's Binding Operational Directive 26-04 tells federal civilian agencies to fix known-exploited flaws on internet-facing systems fastest, especially ones that hand an attacker total control, and to push lower-risk fixes to later. It only binds those agencies, but CISA encourages every organization to work the same way.

Last reviewed October 26, 2026. Plain-language summary, not legal or compliance advice. Cyber Space Training is an independent training site, not affiliated with or endorsed by CISA. Read the full directive for the exact requirements.

What is BOD 26-04?

A Binding Operational Directive is a required instruction from CISA to federal executive branch agencies. BOD 26-04, "Prioritizing Security Updates Based on Risk," is dated June 10, 2026. It replaces two older directives: BOD 19-02 (fixing internet-accessible systems) and BOD 22-01 (the one that created CISA's Known Exploited Vulnerabilities catalog in 2021).

The four questions that set the deadline

Instead of treating every bug the same, the directive sets how fast a flaw must be fixed using four questions:

1. Is the system publicly exposed? Can people outside the organization reach it over the internet without logging in?
2. Is the flaw in the KEV catalog? That's CISA's list of vulnerabilities with evidence of real-world exploitation.
3. Can an attacker automate the whole attack?
4. How much control does an attacker get? Partial control, or total control (including when the exploit reliably reveals login credentials).

Exposed + known-exploited + total control goes to the front of the line. For some of those, the directive pairs the fix with a "forensic triage," a check of whether attackers got in before the patch was applied. Lower-risk flaws can wait for the system's next scheduled major upgrade. The exact timelines are in Table 1 of the directive.

Does it apply to my company?

Not directly. It covers Federal Civilian Executive Branch agencies, and contractors only when their contract says so. But CISA's Oct 23, 2026 KEV alert says: "CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities."

What a small team can borrow from it

• Know what faces the internet. You can't prioritize exposed systems if you don't have a list of them.
• Check the KEV catalog against that list. Browse or search CISA's KEV catalog, or sign up for CISA email updates to hear when entries are added.
• Fix exposed, known-exploited flaws first. Then work down the list.
• After an urgent patch, ask "were we already hit?" Patching closes the door. It doesn't tell you whether someone walked through it first.

Idea: a weekly "newly exploited flaws" card

We're considering a short weekly card that points to what CISA added to the KEV catalog that week, with one plain-English line per entry and a link to CISA. The card below is an example layout only. It is not a live feed and won't update.

Sources

• CISA: BOD 26-04, Prioritizing Security Updates Based on Risk (checked Oct 26, 2026)
• CISA: BOD 26-04 Implementation Guidance (checked Oct 26, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog, Oct 23, 2026 (checked Oct 26, 2026)
• CISA: Known Exploited Vulnerabilities Catalog (checked Oct 26, 2026)
• CISA: Reducing the significant risk of known exploited vulnerabilities (KEV criteria) (checked Oct 26, 2026)