Policy · 1 source · latest 2h

CISA's BOD 26-04 sets a three-day deadline for the most serious actively exploited flaws

POLICYCISAredteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

CISA BOD 26-04 (10 June 2026) supersedes BOD 19-02 and BOD 22-01 and scores each vulnerability on four SSVC-derived variables: asset exposure, KEV status, exploit automation and technical impact. Tier 1 (KEV plus total control) requires remediation within 3 days with concurrent forensic triage; tier 2 requires 3 days without triage; tiers 3 to 5 allow 14, 60 or next-upgrade timelines. Isolation and uninstalling the vulnerable software count as valid remediation. Preserve volatile evidence before patching, and reassess exposure and KEV status as clocks can change overnight.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Identify internet-facing assets and check whether any are affected by KEV-listed vulnerabilities.
Where patching cannot be done within three days, isolate or uninstall the vulnerable software as a compensating control.
Capture volatile evidence such as memory and registries before applying patches to systems that may be compromised.
Contractors and cloud providers handling federal data should confirm they meet the directive's requirements.

Written by AI from the sources, checked against them

Read the full story at the source