BOD 26-04 replaced the 2021 federal patch deadlines for exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists flaws attackers are already using. A June 2026 directive now sets the federal patch clock.
The Known Exploited Vulnerabilities catalog is a public list kept by the US Cybersecurity and Infrastructure Security Agency, known as CISA. It names software flaws that attackers are known to be using. Each listed flaw has a CVE identifier, a fix or clear mitigation, and reliable evidence of exploitation in the wild. The catalog tracks flaws attackers are already using, not every bug that exists.
The list matters beyond US government networks. CISA asks organisations to use it as an input to their vulnerability management prioritization framework, and federal agencies have deadlines tied to it. The rules that set those deadlines changed on June 10, 2026, so timelines from the 2021 directive no longer apply to federal agencies.
What each catalog entry records
Each entry shows the CVE number, with a link to its CVE record, and the vendor and product. It gives a name and description for the flaw and lists related weakness categories. Entries also record whether the flaw is known to be used in ransomware campaigns, whether forensic triage is required under BOD 26-04, the date CISA added it, and a due date. Read together, the date added and the due date show how long a flaw has been listed and when its deadline falls. Each entry also carries a standard action note on remediation, plus a notes field with advisory and NVD links.
The catalog page showed 1,779 results, arranged in pages of 20. The most recent addition was dated November 10, 2026. Six entries on the first page share that date, including Google Chromium CVE-2026-125350, Cisco CVE-2026-20320 and Microsoft Office CVE-2026-124194.
CISA also lets the public nominate actively exploited vulnerabilities that are not yet in the catalog. The catalog is also available in CSV and JSON formats.
How a flaw gets onto the list
Under the 2021 directive, BOD 22-01, a flaw had to meet three requirements. It needed a CVE ID, clear remediation guidance, and reliable evidence that it was exploited in the wild. The directive's FAQ lists these three requirements for adding a flaw to the catalog.
The same FAQ said CISA updates the catalog within 24 hours of evidence of known exploitation. That commitment comes from a directive that is now revoked.
The catalog page describes the list as the authoritative source of vulnerabilities that have been exploited in the wild. The three requirements above are the ones published with the 2021 directive.
Deadlines under the 2021 directive
BOD 22-01 was issued on November 3, 2021. It gave federal agencies six months to fix listed flaws whose CVE IDs were assigned before 2021. For all other listed flaws, the deadline was two weeks.
CISA could adjust those periods where a flaw posed grave risk to the federal enterprise. The directive covered software and hardware on federal information systems, including systems hosted by third parties for an agency, and systems that another entity operates for an agency to handle its information.
BOD 22-01 is now marked as revoked and superseded by BOD 26-04, which was issued on June 10, 2026.
What BOD 26-04 changed
BOD 26-04, titled Prioritizing Security Updates Based on Risk, was issued on June 10, 2026, according to CISA's directive page. It replaces BOD 19-02, issued April 29, 2019, which covered internet-accessible systems, and it consolidates BOD 22-01. SecurityWeek's report on the directive is dated June 11, one day after CISA's date.
The new directive replaces the two fixed periods of 2021 with four questions. For each vulnerability, agencies ask whether the asset is publicly exposed, whether the CVE is in the catalog, whether an adversary can automate every step of exploitation, and whether exploitation gives partial or total control of the asset.
CISA publishes catalog status, automatability and technical impact for each CVE. Agencies should follow CISA's Internet Exposure Reduction Guidance to determine exposure. SecurityWeek reports, attributing the detail to CISA, that timelines are based on the technical impact of each flaw.
“The catalog tracks flaws attackers are already using, not every bug that exists.”
Clocks, phases and who must follow them
For a catalog flaw, the clock starts at the earlier of two events. CISA adds the CVE to the catalog, or the agency finds the vulnerability on an asset and updates the CDM Dashboard. Days are calendar days, and timelines change with the facts. Taking an asset off the internet, for example, changes its exposure status and can extend its deadline.
The remediation timelines appear in Table 1, which is an image on the directive page. The directive text confirms one period: three days for remediation or mitigation of entries that require forensic triage, alongside the triage itself. SecurityWeek reports three days for the highest-risk cases and 14 or 60 days for lower-risk weaknesses. Those 14 and 60 day periods have not been confirmed against the table.
The rollout has three phases. Phase I, which is immediate, updates vulnerability management policies, monitors catalog updates and automates CDM reporting. Phase II, within 60 days, updates processes for CVE data and the catalog. Phase III, within 180 days, requires agencies to remediate on the table timelines and tag all internet-reachable assets.
The directive covers federal civilian executive branch systems. It excludes statutorily defined national security systems and certain systems of the Department of War and the Intelligence Community. Contractors fall outside it unless a governing procurement contract directs otherwise, and agencies review their contracts with contracting officers. For cloud services that are not FedRAMP-certified, agencies work directly with the provider, and any deviations must be documented and communicated to the agency.
Agencies that automate KEV status reporting use the CDM Dashboard. Those that do not must report KEV status manually every two weeks in Phase I, and send asset tagging data to CISA every seven days in Phase III. CISA will publish a standard data schema within 60 days.
What it means outside federal agencies
Both directives are written for federal agencies. A company that sells to those agencies may find its obligations arrive through contract terms, since the 2026 directive reaches contractors only where a governing contract says so.
The catalog page addresses organisations in general. It says they should use the KEV catalog as an input to their vulnerability management prioritisation framework. The action text in each entry also places responsibility on stakeholders to assess each asset's internet exposure and follow BOD 26-04 patching guidance.
For everyone else, the catalog is a public list of flaws with evidence of exploitation in the wild. A patch policy that still cites the 2021 deadlines describes rules that BOD 22-01's revocation has replaced for federal agencies.
