3-Day Patch Mandate: What CISA BOD 26-04 Changes Now
CISA BOD 26-04 is the binding operational directive issued on June 10, 2026 that obliges federal agencies to patch internet-exposed systems within three calendar days when a vulnerability meets all four high-risk criteria. It matters far beyond government networks: the directive discards CVSS scores as a scheduling signal, replaces them with an asset-specific risk matrix, requires forensic triage in the fastest tier, and is being adopted voluntarily by private cloud and infrastructure teams as a defensible prioritization framework.
What CISA BOD 26-04 Requires
Formally titled “Prioritizing Security Updates Based on Risk”, the directive binds Federal Civilian Executive Branch agencies and arrived with same-day implementation guidance from CISA. It revoked the two directives that previously governed federal patching: BOD 19-02, which granted 15 days for critical and 30 days for high findings, and BOD 22-01, the directive behind the Known Exploited Vulnerabilities (KEV) catalog. Remediation timelines under the new model are tiered by how many risk criteria a vulnerability satisfies on a specific asset, not by its CVSS base score. Where metadata about a CVE is missing and the flaw is not listed in the KEV catalog, CISA treats the clock as 60 days until better data arrives.
| Criteria met | Remediation deadline | Additional obligation |
|---|---|---|
| All four risk criteria | 3 calendar days | Forensic triage for compromise before or alongside patching |
| Moderate-risk combinations | 14 calendar days | Standard remediation tracking |
| Lower-risk configurations | 60 calendar days | Deferral to the next scheduled upgrade cycle where eligible |
| Unknown CVE metadata, not in KEV | 60 days by default | Reassess as soon as metadata is published |
The Four-Variable Risk Matrix
Instead of asking how severe a CVE looks on paper, CISA now asks how exploitable it is on the specific asset that hosts it. The model scores four binary decision points: publicly accessible via the internet, KEV catalog status, exploit automation potential, and technical impact. Internet exposure asks whether unauthenticated parties can reach the asset over a public network. KEV status asks whether the flaw is already being exploited. Automation asks whether an adversary can weaponize it without manual steps. Technical impact asks whether successful exploitation yields total control of the component, with heuristics such as attacker-installed arbitrary software, full-privilege accounts, or confidentiality and integrity impact both rated High.
The sixteen possible combinations collapse into the three operational tiers above. Two operational consequences deserve attention from cloud teams. First, CISA states that if exposure information about an asset is not available, out of an abundance of caution, CISA will treat the asset as publicly exposed for purposes of calculating patching timelines — ignorance of your inventory makes every deadline shorter, not longer. Second, the implementation guidance explicitly names cloud provider tagging and labeling features as a discovery method, meaning an authoritative, exposure-tagged asset inventory in your cloud control plane is now the prerequisite for knowing which clock applies to which workload. A mapped defense stack, like the one in our cloud security layers diagram, gives triage teams the reference points they need when exposure data decides the deadline.
Ivanti Sentry: The First Test
The directive met reality within 48 hours. CVE-2026-10520, an unauthenticated OS command injection flaw in Ivanti Sentry carrying a CVSS score of 10.0, hit the KEV catalog on June 12, and agencies were ordered to remediate by June 14 — the first enforcement of the three-day tier. Shadowserver had confirmed that attackers had begun backdooring internet-exposed Sentry gateways within 40 hours of a public proof-of-concept exploit being published. The pattern is the exact threat model CISA built the directive around: an edge security appliance, unauthenticated code execution, full takeover potential, and a public exploit that collapsed the time between disclosure and weaponization. Cloud hosts face the same physics, as the wide Linux exposure documented for Bad Epoll CVE-2026-46242 demonstrates: when a working exploit lands, dwell time is measured in hours, not weeks.
Forensic Triage Before Patching
The sharpest operational change is that the fastest tier now demands incident-response discipline, not just change management. Before or alongside emergency patching, agencies must determine whether systems were already compromised during the exposure window, because patching a backdoored host without investigating first lets an adversary persist through credentials and implants that survive the patch cycle. The directive’s requirement is that an adequate forensic triage analysis is performed; the target step timelines are recommended practice, not mandates. CISA’s guidance sequences six steps: scoping within roughly two hours of a KEV addition, preserving and collecting volatile evidence before any remediation disturbs artifacts, critical patching and stabilization, containment coordinated so it does not tip off the attacker, triage analysis looking for unauthorized access, persistence and exfiltration, and a documented escalation decision at the 72-hour mark. Notably, CISA does not issue waivers for hard-to-implement patches — teams are expected to engage, not to defer silently.
Cloud Team Implementation Checklist
- Maintain an authoritative asset inventory with exposure, environment and ownership tags synchronized from your cloud provider control plane, so the four decision points can be evaluated automatically when a new CVE drops.
- Ingest the KEV catalog into your pipeline and alert on any listing that touches an internet-facing asset, treating KEV addition as the start of a forensic triage runbook rather than a ticket.
- Pre-stage the triage kit: out-of-band communications, volatile evidence collection procedures, containment playbooks and IOC sweep templates, so the first hours are execution rather than planning.
- Map CVSS-only scanner output onto the four variables, adding automation-potential and impact context so prioritization matches exposure reality instead of deferring an internet-exposed, fully automatable flaw behind an irrelevant high score.
- Document every risk decision with rationale; auditable prioritization is the part of the directive most likely to migrate into contracts and regulation next.
Organizations outside the federal sphere face no legal obligation, yet the trajectory of the KEV catalog suggests the four-variable model will reach RFPs, insurance underwriting and audit frameworks within a few years. Adopting it early costs an inventory discipline exercise; ignoring it leaves teams sequencing patches by a score that adversaries stopped respecting.