Free tool

BOD 26-04 calculator: your patch deadline for any CVE

BOD 26-04 replaced BOD 22-01 on 10 June 2026. Your deadline now depends on four answers: is the asset publicly exposed, is the CVE in CISA's KEV catalogue, is exploitation automatable, and is the technical impact total or partial. Table 1 turns them into 3, 14 or 60 calendar days, or "fix on system upgrade", and flags the worst cases for forensic triage.

CISA publishes Table 1 only as an image. Here it is as text, with a calculator, a KEV lookup that fills in the KEV answer, and a bulk queue that sorts a CVE list by due date. Free to use. Only downloads need a plan.

Data dates. CISA KEV catalogue version 2026.11.03, released 2026-11-03, 1,767 entries (checked 2026-11-03). Sources: CISA. Copied to our own database and refreshed automatically; if a refresh fails, the previous copy keeps serving with its own date.

No download, no card

1. One vulnerability on one asset

Optional: CVE id, to fill "In KEV" from CISA's catalogue

Publicly exposed

Agency-owned or managed IT resource accessible to unauthenticated or untrusted entities via public networks, such as the internet (CISA's definition).

In KEV

Is the CVE in CISA's Known Exploited Vulnerabilities catalogue?

Automatable

Can an attacker reliably automate reconnaissance, weaponisation, delivery and exploitation (SSVC definition)?

Technical impact

Total: the attacker gains total control of the component's behaviour. Partial: limited control or information (SSVC definition).

Table 1, row 1

3 days + forensic triage

Forensic triage required. Treat the asset as possibly already compromised: CISA's guidance suggests scoping within 2 hours, preserving evidence in 2 to 24 hours, and an escalation decision by 48 to 72 hours.

Date you identified it on the asset

Clock starts 2026-11-04. Due 2026-11-07 (3 days, calendar days).

BOD 26-04 Table 1: remediation timelines (calendar days from the clock start). Transcribed from CISA's image and checked 2026-11-03.
#	Publicly exposed	In KEV	Automatable	Technical impact	Timeline
1	Yes	Yes	Yes	Total	3 days + forensic triage
2	Yes	Yes	Yes	Partial	3 days
3	Yes	Yes	No	Total	3 days + forensic triage
4	Yes	Yes	No	Partial	14 days
5	Yes	No	Yes	Total	3 days
6	Yes	No	Yes	Partial	14 days
7	Yes	No	No	Total	14 days
8	Yes	No	No	Partial	60 days
9	No	Yes	Yes	Total	3 days + forensic triage
10	No	Yes	Yes	Partial	14 days
11	No	Yes	No	Total	14 days
12	No	Yes	No	Partial	14 days
13	No	No	Yes	Total	60 days
14	No	No	Yes	Partial	60 days
15	No	No	No	Total	Fix on system upgrade
16	No	No	No	Partial	Fix on system upgrade

2. Remediation queue from a list

Paste up to 500 CVE ids or a scanner export. We read the ids in your browser and look up KEV status; you set exposure, automatability and impact for the batch, then adjust any row.

Exposed Automatable Impact

Privacy. Pasted lists and uploaded files are read in your browser. Only the CVE ids found in them are sent to our server, to look them up in our own copy of the data. We do not store them, and no third party receives them.

Table 1 as text

BOD 26-04 Table 1: remediation timelines (calendar days from the clock start). Transcribed from CISA's image and checked 2026-11-03.
#	Publicly exposed	In KEV	Automatable	Technical impact	Timeline
1	Yes	Yes	Yes	Total	3 days + forensic triage
2	Yes	Yes	Yes	Partial	3 days
3	Yes	Yes	No	Total	3 days + forensic triage
4	Yes	Yes	No	Partial	14 days
5	Yes	No	Yes	Total	3 days
6	Yes	No	Yes	Partial	14 days
7	Yes	No	No	Total	14 days
8	Yes	No	No	Partial	60 days
9	No	Yes	Yes	Total	3 days + forensic triage
10	No	Yes	Yes	Partial	14 days
11	No	Yes	No	Total	14 days
12	No	Yes	No	Partial	14 days
13	No	No	Yes	Total	60 days
14	No	No	Yes	Partial	60 days
15	No	No	No	Total	Fix on system upgrade
16	No	No	No	Partial	Fix on system upgrade

How to read it

Exposure and KEV membership pull a deadline in. Row 8 (exposed, not in KEV, not automatable, partial impact) is the only row at 60 days among exposed assets; unexposed, unlisted, non-automatable findings wait for the next system upgrade (rows 15 and 16).
Three rows carry forensic triage: exposed and in KEV with total impact (rows 1 and 3), and unexposed, in KEV, automatable with total impact (row 9).
Phases in the directive: Phase I effective immediately, Phase II within 60 days of issuance and Phase III within 180 days (about 7 December 2026 counting from 10 June). See the directive for what each phase requires.
Severity (CVSS) is not an input. A low-scored flaw in KEV on an exposed, automatable, total-impact system is a 3-day item. Use the CVSS calculator for severity and the EPSS lookup for likelihood.

BOD 22-01 and BOD 19-02 are revoked. If a policy, contract or insurer questionnaire still cites BOD 22-01 deadlines, it is out of date.

Frequently asked questions

What replaced BOD 22-01?

CISA Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk", issued on 10 June 2026. CISA states that it supersedes and revokes BOD 19-02 and BOD 22-01. The remediation deadline is no longer a single date per KEV entry; it comes from a 16-row table that depends on four facts about the vulnerability and the asset.

What are the BOD 26-04 deadlines?

Table 1 gives one of four outcomes: 3 days, 14 days, 60 days, or "fix on system upgrade". The inputs are whether the asset is publicly exposed, whether the CVE is in the CISA KEV catalogue, whether exploitation is automatable, and whether technical impact is total or partial. Days are calendar days. The rows for exposed or KEV-listed vulnerabilities with total technical impact and automatable exploitation (or exposed and in KEV with total impact) also require forensic triage.

When does the clock start?

CISA says the Table 1 timelines begin when either CISA adds the vulnerability to the KEV catalogue or the agency identifies it, whichever happens first. This calculator takes the earlier of the KEV "date added" and the date you enter.

What does "forensic triage required" mean?

The KEV feed now has a forensicTriage field, set to Yes for the most urgent cases. CISA's implementation guidance asks agencies to treat such an asset as possibly already compromised and to look for evidence before and while patching. The guidance recommends timings: scope within 2 hours, preserve evidence in 2 to 24 hours, patch in 2 to 24 hours, contain in 6 to 24 hours, analyse in 24 to 48 hours and decide on escalation in 48 to 72 hours. See the implementation guidance linked below for the exact wording.

Does BOD 26-04 apply to my company?

Binding force: the directive applies to agency assets in any federal information system, with contractors generally excluded unless a contract says otherwise. A private company is not bound by it. It is still a published, risk-based benchmark that insurers, auditors and customers may point to, and the KEV catalogue it builds on is public.

What counts as publicly exposed?

CISA defines it as any agency-owned or agency-managed IT resource accessible to unauthenticated or untrusted entities via public networks, such as the internet, regardless of its physical or logical location. Removing an asset from public reach moves it to the "No" rows of the table.

How are Automatable and Technical impact decided?

They use the SSVC (Stakeholder-Specific Vulnerability Categorization) definitions from CERT/CC. Automatable asks whether an attacker can reliably automate the steps from reconnaissance to exploitation. Technical impact asks whether exploitation gives total or only partial control of the affected component. This calculator asks you to set them because they depend on the CVE and your configuration; CISA publishes enrichment for many CVEs in its Vulnrichment data, which we do not copy.

What changed from the old 14 and 21 day KEV dates?

Looking at the KEV feed itself on 3 November 2026: entries added since 10 June 2026 have due dates 3 or 14 days after they were added, and those flagged for forensic triage have 3 days. Entries added before that date show a mix of earlier due dates such as 14 or 21 days. CISA computes the feed date from available exposure data, so the date in the feed is a default; your own asset's deadline follows Table 1.

Sources

Primary documents, accessed 3 November 2026. Our prioritisation labels are ours; the rules, dates and data come from these.

CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (issued 10 June 2026) — Table 1, definitions, clock start, calendar days, revokes BOD 19-02 and BOD 22-01 (accessed 2026-11-03)
CISA, BOD 26-04 implementation guidance (forensic triage requirements) (accessed 2026-11-03)
CISA, Known Exploited Vulnerabilities Catalog (accessed 2026-11-03)
CISA KEV JSON feed and JSON Schema — Fields: dueDate, knownRansomwareCampaignUse, forensicTriage (accessed 2026-11-03)
CERT/CC, SSVC: Stakeholder-Specific Vulnerability Categorization — BOD 26-04 Table 1 is informed by SSVC; CERT/CC model cisa:DT_BOD2604:1.0.0 (accessed 2026-11-03)

Educational, not advice. BOD 26-04 binds US federal civilian agencies; for everyone else it is a published benchmark. Score severity with the CVSS calculator.

More security tools

The tools people use most on PlayCISO.

All tools

Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.