CISA Binding Operational Directive 26-04 · issued 10 June 2026 · timelines bind from 7 December 2026

BOD 26-04 sets the deadline from four facts. Three are on the CVE page. The fourth is yours.

BOD 26-04 replaced BOD 22-01's single KEV deadline with a table. Whether the system is reachable from the internet, whether the CVE is in CISA's KEV catalog, and CISA's own scores for whether exploitation is automatable and how much control it gives an attacker decide between 3 days, 14 days, 60 days and the next system upgrade. Every vciy CVE page states the last three with their dates and gives you both deadlines, because only you know the first.

No CVE to hand? Record a patch-by date for CVE-2024-3400, this page's worked example: a PAN-OS flaw on an internet-facing firewall. Not sure which CVEs touch you? Check your software, free and with no account.

Try it on CVE-2024-3400

Record the date you will have it fixed, against the deadline that applies.

The record opens with that CVE's facts already filled in: KEV status and CISA's due date, EPSS and its date, fixed versions, each from its public source. Our server dates it. If CISA lists it, rescores it or moves the deadline before your date, you hear about it. The first 100 records are free.

Record a patch-by date for CVE-2024-3400 Open CVE-2024-3400 See the table

Table 1: sixteen combinations, five timelines.

Calendar days, counted from whichever comes first: CISA adding the CVE to the KEV catalog, or the agency finding it on an asset. Three combinations also require forensic triage, collected before the fix destroys the evidence of whether it was already used against you.

**Source:** CISA publishes Table 1 (BOD 26-04, Appendix A) only as an image. These rows follow Datadog's text transcription of it and agree with every cell CISA states in text. Read the directive on cisa.gov.
Publicly exposed	In KEV	Automatable	Technical impact	Remediate within
Yes	Yes	Yes	Total control	3 days, with forensic triage first
Yes	Yes	Yes	Partial control	3 days
Yes	Yes	No	Total control	3 days, with forensic triage first
Yes	Yes	No	Partial control	14 days
Yes	No	Yes	Total control	3 days
Yes	No	Yes	Partial control	14 days
Yes	No	No	Total control	14 days
Yes	No	No	Partial control	60 days
No	Yes	Yes	Total control	3 days, with forensic triage first
No	Yes	Yes	Partial control	14 days
No	Yes	No	Total control	14 days
No	Yes	No	Partial control	14 days
No	No	Yes	Total control	60 days
No	No	Yes	Partial control	60 days
No	No	No	Total control	Fix at the next system upgrade
No	No	No	Partial control	Fix at the next system upgrade

Where each of the four facts comes from.

**Text cited:** CISA, BOD 26-04 implementation guidance.
Fact	What CISA says	Where vciy shows it
Publicly exposed	An asset is publicly exposed if it is "accessible to unauthenticated or untrusted entities via a public network."	Nowhere, because only you know. Every CVE page gives the deadline both ways.
In KEV	CISA's Known Exploited Vulnerabilities catalog, with its own due date per entry.	The KEV row, with the date CISA listed it and the date vciy learned it.
Automatable and technical impact	CISA's SSVC scores from its Vulnrichment data, published in CISA's own section of each CVE record. For a CVE not in KEV that CISA has not scored, CISA "will treat its values as "no" and "total," respectively."	The BOD 26-04 row, naming CISA's scores and the day it scored them, or saying the directive's defaults were used.
The fastest cell	"if CISA determines that the vulnerability is present in a publicly exposed asset, the technical impact is total, and that it is automatable by an adversary, the KEV's due date will reflect a 3-day patching deadline."	The same row, marked when either deadline is 3 days.

Federal agencies are bound. Their suppliers inherit it through contracts and FedRAMP.

The directive binds federal civilian executive branch agencies, which must review their contracts so suppliers can meet the same timelines. FedRAMP's notice 0014: "By December 7, 2026, agencies must begin evaluating and remediating vulnerabilities following the timelines in BOD 26-04." It adds that "the timeframes stipulated in both FedRAMP's Rules and CISA's BOD 26-04 are maximum timeframes." CISA encourages every other organization to adopt the same approach.

For a cloud service provider, see the FedRAMP page: its 2026 rules replace the POA&M with accepted vulnerabilities, and the date each evaluation closed has to prove itself.

A deadline moves when the facts move. Your record should hear about it.

A CVE that CISA lists after you scheduled the fix moves to a shorter row. A patch-by record on vciy hears about that listing and tells you when the new deadline lands before your date. On every tier, records cannot be altered or removed, by anyone, including you: each version is hashed into a chain with the one before it, under a published canonical form, and every export carries the hashes, so a standalone verifier recomputes them without any code or access from us. A change is a new version; the one before it stays readable.

Free keeps 100 records. Practitioner and Custody have no limit.
Tier	What it gives you under BOD 26-04
Free $0, named Community on the pricing page	The deadline row on every CVE page, and dated patch-by records that alert you when CISA's listing or deadline beats your date. Start free
Practitioner $20 a month or $200 a year.	Every product you run watched, searchable history, and exports a reviewer can check without us.
Custody $10,000 a year.	An auditor or contracting officer reads your records directly, with a dated log of what they opened. Custody starts with an evidence review: write to sales@vciy.com.

For the other obligations an exception answers to, see the compliance pages.