CISA's 2026 Directives, Plainly: Patch by Risk (BOD 26-04) and Get EOL Off the Edge (BOD 26-02)

Updated: July 2026  ·  Policy analysis — verified against the directive texts on cisa.gov — methodology

In 2026 the US government rewrote how it handles dying software — twice. On February 5, CISA's Binding Operational Directive 26-02 ordered federal civilian agencies to hunt down end-of-support devices on their network edges — declaring flatly that such devices "should not reside anywhere on federal networks." Then on June 10, BOD 26-04 replaced the government's decade-old patching rules with a risk-scoring model: four questions about each vulnerability decide whether an agency has three days to fix it or can wait for the next scheduled upgrade. Binding directives apply only to federal civilian agencies — but they are the clearest public statement yet of what competent vulnerability management looks like, and they quietly rest on a discipline most private organizations still lack: knowing the lifecycle status of everything you run.

BOD 26-04: four questions replace the severity score

Since 2021, federal patching ran on CISA's Known Exploited Vulnerabilities catalog: if a CVE landed in the KEV, agencies raced a fixed clock. BOD 26-04 supersedes that directive (and the 2019 remediation rules) with something more surgical. For each vulnerability on each asset, four questions set the deadline:

1. Asset Exposure — is the vulnerable asset publicly reachable?
2. KEV Status — is the CVE in CISA's Known Exploited Vulnerabilities catalog?
3. Exploit Automation — can an adversary automate every step of exploitation?
4. Technical Impact — does exploitation yield partial or total control?

Worst case on all four — publicly exposed, actively exploited, automatable, total control — and the agency has three calendar days to remediate plus a mandatory forensic triage to check whether it's already too late. At the other extreme, a low-risk finding can legitimately wait for the next scheduled system upgrade. The full matrix lives in the directive's Table 1; CISA publishes three of the four answers for every CVE through its Vulnrichment program, so most of the scoring arrives pre-computed. Deadlines are dynamic: pull a system off the internet and its clock relaxes; let the CVE hit the KEV catalog and the clock tightens — automatically.

What CISA is saying with this design deserves to be said plainly: severity is not risk. A CVSS 9.8 on an internal system with no exploit in the wild can matter less than a 7.5 being mass-exploited on an internet-facing box. The government has now made acting on that distinction mandatory for itself.

BOD 26-02: end-of-support became a compliance deadline

Four months earlier, CISA aimed a whole directive at a single category: end-of-support edge devices — the firewalls, VPN appliances, routers and load balancers that face the internet and no longer receive vendor patches. The directive's reasoning reads like our own risk-score documentation: these devices are "especially vulnerable to cyber exploits targeting newly discovered, unpatched vulnerabilities," advanced actors run "widespread exploitation campaigns" against them, and — the operative line — unlike most attack vectors, this one is fixable with "proven lifecycle management practices."

The requirements: agencies had three months to identify and remediate EOS edge devices, using a CISA-maintained EOS Edge Device List — yes, the US government now curates its own end-of-life database — and must build lifecycle management that spots hardware and software approaching end of support and budgets replacements before the dates hit. The underlying OMB policy (Circular A-130) states the principle in full generality: unsupported systems and components must be "phased out as rapidly as possible."

Where the two directives meet — and the gap between them

Read together, the directives cover the two ends of the problem: 26-04 optimizes patching for software that can be patched; 26-02 evicts a class of hardware that no longer can be. The gap is everything in between: end-of-life software that isn't an edge device. An EOL database, framework or OS breaks the 26-04 model in a specific way — the directive defines remediation as eliminating the vulnerability "through patching, decommissioning the system, or another action," but for software past end of life, the patching option is permanently gone. Every future KEV entry against that product arrives pre-aged: exploited, often automatable, and unfixable except by migration or paid extended support. Risk that cannot decay.

That's why lifecycle status belongs alongside CISA's four questions as the fifth input. It's the one our EOL Risk Score is built around — days to end of life, CVE exposure, and KEV presence, composited the same way the directive composites its variables — and the reason we track which EOL products appear in the KEV catalog: those are the vulnerabilities where the 3-day tier's assumption (a patch exists) fails by definition.

If you're not a federal agency, why care

• The blueprint is free. BOD 26-04's four-question triage and 26-02's lifecycle-management requirements are public, tested at federal scale, and directly adoptable. Most organizations still patch by CVSS severity and discover EOL by surprise.
• Regulators copy regulators. The EU's CRA reporting obligations begin September 11, 2026 (our analysis); auditors and cyber-insurers increasingly borrow federal language. "We follow the BOD 26-04 model" is becoming an answer assessors recognize.
• Contractors are next. The directive tells agencies to review contracts for what compliance requires of vendors — federal suppliers should expect these expectations to flow downstream.

The 20-minute private-sector version

1. Inventory with lifecycle status — you cannot triage what you haven't dated. Paste your stack into the Stack Scanner for EOL status and risk scores in one pass.
2. Adopt the four questions for patch priority; CISA's Vulnrichment data answers three of them for any CVE.
3. Treat EOL as its own tier — anything past end of support can never satisfy a patch deadline again. Plan migration, or bridge with commercial extended support while you do.

Frequently Asked Questions