CISA BOD 26-04: are your patch windows keeping up?

TL;DR: CISA BOD 26-04 replaces one-size-fits-all vulnerability deadlines with a four-factor model that weighs asset exposure, KEV status, exploit automation and technical impact, and the highest-risk combinations now face a three-calendar-day remediation window plus possible forensic triage, according to Action1. That matters because patching speed alone no longer answers whether exploitation already happened or whether a slower path is still defensible.

Editorial analysis by NHI Mgmt Group, based on content published by Action1: “CISA BOD 26-04: Why the 72-Hour Patching Window May Be Too Long”.

By the numbers:

• Action1’s 2026 Software Vulnerability Ratings Report found that 28.3% of vulnerabilities with publicly available exploits were attacked within 24 hours of disclosure.

Key questions

Q: What breaks when patching is not risk-based?

A: Patch queues become blind to whether a vulnerability is actually exploitable right now, which means teams waste time on low-risk fixes while urgent exposures remain open.

Q: Why do Known Exploited Vulnerabilities require faster remediation than standard vulnerability findings?

A: Known Exploited Vulnerabilities matter because they confirm real attacker activity, which changes the decision from likelihood to urgency.

Q: How do teams know whether urgent patching worked?

A: They know it worked when the fix is deployed, the affected asset is verified, and forensic checks show no sign that an attacker got there first.

Practitioner guidance

• Map patch SLAs to exploit context Classify vulnerabilities by public exposure, KEV status, automation potential and technical impact before assigning an internal remediation window.
• Separate patch closure from compromise confirmation Require forensic triage for high-risk cases so the team can confirm whether exploitation occurred before remediation completed.
• Prioritise internet-facing assets first Move publicly exposed endpoints, services and workloads to the front of the queue whenever the vulnerability can be exploited quickly or at scale.

Bottom line: CISA BOD 26-04 replaces blanket vulnerability deadlines with context-driven remediation that reflects exposure, exploitation evidence, automation and impact.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →