BOD 26-04 and the KEV: what forensic triage means

CISA’s Known Exploited Vulnerabilities catalogue now carries a new label on many entries: “Forensic triage required per BOD 26-04”. Google’s Brotli flaw, Node2Shell, joined the catalogue on 27 October. PHP2Shell joined the day before with the triage flag set to Yes. If you treat every KEV as “patch by the due date”, you are missing half of the new rule.

Applies to: US Federal Civilian Executive Branch agencies. Useful practice for UK, EU and private operators; not binding on them.

What BOD 26-04 changed

On 10 June 2026 CISA issued Binding Operational Directive 26-04 (opens in a new tab), Prioritizing Security Updates Based on Risk. It revoked BOD 22-01, the directive that made the KEV catalogue a federal patching mandate, and replaced a single “patch KEVs” rule with a decision table.

The urgency of a fix now depends on four questions: is the asset publicly exposed; is the CVE in the KEV catalogue; can an adversary automate exploitation; and does exploitation give partial or total control of the asset. CISA publishes the last three for every CVE through its Vulnrichment programme. Agencies answer the first from their own asset data, with help from Cyber Hygiene scanning.

For the highest-risk combination, publicly exposed, in the KEV, automatable and total control, the timeline is three calendar days and a forensic triage of the asset. That is the “& forensic triage” cell in Table 1 of the directive. Lower-risk combinations get longer windows, or “fix on system upgrade”. CVSS “critical” and “high” labels no longer drive the federal timeline on their own.

What “forensic triage” means

CISA’s implementation guidance (opens in a new tab), last updated 25 August 2026, spells out six steps. The timeline targets are recommended practice, not hard BOD deadlines; the requirement is that an adequate triage happens.

  • Scope (target: first two hours after the KEV addition): identify in-scope systems, stand up an out-of-band channel, activate the triage team.
  • Preserve and collect (2–24 hours): take volatile data first, then less-volatile artefacts, and log every item. Do not patch before you have the evidence you need.
  • Critical patching and stabilisation (2–24 hours): apply the fix once evidence is collected, and stabilise anything the patch breaks.
  • Contain (6–24 hours): isolate impacted and suspected systems without tipping off an actor still inside.
  • Triage analysis (24–48 hours): look for unauthorised access, persistence, lateral movement, staging and exfiltration, and document indicators of compromise.
  • Escalation decision (48–72 hours): write a short report. No compromise found means heighten monitoring and finish remediation. Confirmed compromise means report to CISA and escalate to full incident response. Suspected but unconfirmed means keep triaging and decide whether to escalate.

Where a KEV entry itself names specific triage steps, follow those instead of the generic six.

How to read a KEV row now

Open the KEV catalogue (opens in a new tab) and look past the due date. Each recent entry carries a “Forensic triage required per BOD 26-04” Yes/No flag, notes pointing at BOD 26-04 and the triage guidance, and often a note that the due date is calculated from the vulnerability-response table using CISA’s best view of public exposure. Your own exposure answer can change the clock: taking a system off the internet moves it out of the three-day cell.

Two October examples show the split. CVE-2026-111497 (Node2Shell / Brotli) was added on 27 October with forensic triage set to No and a due date of 10 November. CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) (opens in a new tab) were added on 26 October with forensic triage set to Yes. Same catalogue, different obligations.

What this means outside the US federal estate

BOD 26-04 binds Federal Civilian Executive Branch agencies. It does not bind UK, EU or private-sector operators. It is still useful elsewhere, for three reasons.

  • The KEV catalogue remains the best public list of vulnerabilities with reliable evidence of exploitation. Treating a new KEV as a priority is still sound practice even when the BOD does not apply to you.
  • The forensic-triage flag is a free signal. When CISA says triage is required, assume the vulnerability is the sort that attackers leave behind persistence, and plan evidence collection before you wipe and rebuild.
  • Vendors and cloud providers that sell to the US government are aligning to the same clock. FedRAMP will require mandatory adoption of its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by 7 December 2026, to align with BOD 26-04, so the pressure will show up in SaaS patch SLAs even if you are not a federal agency.

A practical checklist for this week

  • Subscribe to KEV updates, or poll the JSON feed (opens in a new tab), and read the triage flag on every new row.
  • Keep a short, rehearsed playbook for the three-day-plus-triage cell: who scopes, who collects volatile data, who patches, who decides escalation. Write it before the next PHP2Shell-class addition, not during it.
  • Know which of your assets are publicly exposed. Without that answer you cannot apply the table. Where agencies have not tagged exposure, CISA applies a best-effort decision tree (public IP, network asset type, generally public-facing software) before treating the asset as internal.
  • When triage is required, collect first, then patch. The guidance is explicit that patching can destroy the artefacts you need.
  • Cross-check our Alert Tracker against the catalogue; the banner on each Alert now has to live alongside the BOD 26-04 flags on the same CVEs.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)