🧰 Binding Operational Directive 26-04

The items that name it 8

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisory2026-10-29It is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.

  Sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. Requires rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, allows deferring lower-risk vulnerabilities, and sets expectations for checking whet

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  article2026-10-29It is written here as Binding Operational Directive (BOD) 26-04.

  CISA directive that required federal agencies to patch CVE-2026-46300 by Saturday 10.

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisory2026-10-28It is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.

  Sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, requiring rapid remediation of KEV CVEs on publicly exposed assets that grant total control after exploitation, and deferral of lower-risk vulnerabilities

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisory2026-10-27It is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.

  Sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, requiring rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, and setting expectations for when agencies must check for prior compromise

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisory2026-10-26It is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk.

  Sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies: rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, deferral of lower-risk ones, and basic expectations for checking whether threat actors compro

• CISA KEV: Fortinet FortiMail CVE-2026-104286 path traversal, actively exploited, no patch yet
  advisoryIt is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk (sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies).

  BOD

• CISA KEV Catalog Additions — Check Point, Arista VeloCloud, F5 BIG-IP (Sept 22, 2026)
  advisoryIt is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk - vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

  BOD

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisoryIt is written here as Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk: vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

  BOD