The vulnerability management rules just changed. Is your program built for what comes next?
CISA BOD 26-04 replaced CVSS-based patching with a four-variable risk model that can require remediation in 72 hours. This hub is the practitioner-grade guide: the directive explained, the framework, the timelines, and the forensic triage requirement most programs aren't built for.
Three dates. One directive. No extensions after March.
All FCEB agencies must update vulnerability management policies to support ongoing, risk-tiered remediation aligned with BOD 26-04 requirements.
All cloud service providers must implement FedRAMP's Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules to maintain or obtain FedRAMP Certification. The prior 2027 timeline was accelerated because of BOD 26-04.
FedRAMP Certification is revoked for any cloud service offering not in compliance. Corrective action plans must be active before this date — not submitted on it.
What BOD 26-04 is — and what it ended.
A Binding Operational Directive is a compulsory instruction from the Secretary of Homeland Security to all Federal Civilian Executive Branch agencies. Compliance is mandatory. BOD 26-04, issued June 10, 2026, supersedes and revokes both BOD 19-02 (vulnerability remediation for internet-accessible systems) and BOD 22-01 (the original KEV-driven remediation mandate). Both are gone. The new framework replaces them entirely.
The core shift: CVSS severity scores are no longer a required input for federal vulnerability prioritization. What determines urgency now is a four-variable risk assessment — applied to every vulnerability, on every asset, continuously. The directive explicitly names artificial intelligence as the reason: AI is compressing the time between vulnerability disclosure and active exploitation, and a static severity-score approach is too slow and too blunt to keep up.
"CVSS is no longer required. What matters is whether the asset is exposed, the vulnerability is exploited, the exploit is automatable, and the impact is severe."
Four questions. Every vulnerability. Every asset.
Under BOD 26-04, every vulnerability on every in-scope asset is assessed against four binary conditions. The combination of answers determines the remediation tier — and the clock that comes with it. These are not scores. They are yes/no decisions, made with specific data sources.
The definition is intentionally broad. If any scanning method can reach the asset from the internet, the answer is Yes — and the timeline compresses.
CISA adds a CVE only when exploitation in the wild is confirmed. This is not a prediction — it is an observation, and the single strongest urgency signal available.
Automatable exploits move at machine speed. FedRAMP's VER rules go further — providers must assume exploits are automatable unless proven otherwise. The default is Yes.
Total control — full administrative authority or arbitrary code execution — produces the shortest timeline and makes forensic triage mandatory. Partial means constrained access.
Patching a compromised system doesn't evict the attacker.
For the highest-risk vulnerability tier, BOD 26-04 requires forensic triage before remediation — not after. Applying a patch removes the vulnerability. It does not remove a threat actor who already used that vulnerability to gain access. If you patch without checking, you may have secured a beachhead the adversary already controls.
Forensic triage means gathering technical evidence of who accessed the system, when, from where, and using what tools — and determining whether compromise occurred before the patch window opened. For the critical tier, within the same 72-hour window. If evidence indicates probable compromise, the response must escalate to full incident response.
Forensic triage is a required compliance step under BOD 26-04 — not a premium security service. If your current vulnerability program doesn't include a compromise-assessment workflow, it doesn't meet the directive.
Explore Verify solutions ↓If you sell cloud services to the government, this directive reaches you too.
FedRAMP Public Notice NTC-0014 (June 16, 2026) made adoption of the aligned Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules mandatory for all FedRAMP-certified cloud service offerings by December 7, 2026 — with certification revocation after March 7, 2027. The FedRAMP rules exceed BOD 26-04 in key respects, including the "Assume It's Automatable" standard.
Full FedRAMP VDR/VER guidance has moved to its own hub — the December 2026 mandate, the enforcement sequence, and the CSP readiness checklist.
Enter the FedRAMP VDR/VER hub →BOD 26-04 in the AI-discovery era
The directive was written for a world where AI accelerates both vulnerability discovery and weaponization — and that world arrived faster than most programs expected. Project Glasswing's 10,000+ AI-discovered findings will flow into the same KEV catalog and the same four-variable matrix this hub documents. A flaw found by a frontier model in software you run is not a special category: exposure, KEV status, automation, and impact determine your clock, same as ever. What changes is velocity — AI-discovered flaws frequently arrive with demonstrated exploit paths, which shortens the distance between disclosure and KEV listing.
That dynamic just gained a federal dimension. On July 14, 2026, the White House launched Gold Eagle, a Treasury-managed clearinghouse coordinating AI-discovered vulnerability intake across government and industry, built on Executive Order 14409 and confirmed to use Anthropic's Mythos for discovery. The administration has not yet disclosed how Gold Eagle's findings will integrate with the CISA KEV catalog that drives BOD 26-04's four-variable matrix — but any eventual integration means agencies and FedRAMP providers could see a new, federally-coordinated source of KEV additions arriving faster and at greater volume than the current disclosure pipeline. We're tracking Gold Eagle's development on our AI-Discovered Vulnerabilities page → as details emerge. Gold Eagle's technical backbone has since been confirmed as VINCE, a pre-existing coordination platform operated with Carnegie Mellon University's Software Engineering Institute — but whether and how VINCE-routed findings will feed the CISA KEV catalog specifically remains undisclosed as of this writing.
The four-variable model has already produced its shortest deadlines against AI infrastructure itself. In August 2026, CISA added code injection flaws in Langflow and Ray — an AI application platform and the distributed compute engine beneath much of production ML — to the KEV catalog two weeks apart, with Ray drawing a three-day federal remediation deadline. Read the brief on what that pattern means →