When CISA added CVE-2026-96951 (Microsoft Windows Command Injection) and CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass by Spoofing) to the Known Exploited Vulnerabilities Catalog this week, your vulnerability management queue didn't just get two items longer. If you're a Federal Civilian Executive Branch agency, those additions triggered specific remediation timelines under Binding Operational Directive 26-04. If you're not federal, they still represent a decision point about how your organization prioritizes patch work.
The Challenge
BOD 26-04 changed how federal agencies approach vulnerability management. Instead of treating all CVEs with equal urgency based on CVSS scores, the directive requires prioritizing remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation. It also establishes expectations for checking whether threat actors compromised systems before patches were applied.
For agencies implementing BOD 26-04, these two new KEV entries create immediate operational questions:
Which of your publicly exposed assets run the affected Microsoft Windows components or Ivanti Connect Secure instances? Do those assets meet the "total control post-exploitation" threshold that triggers accelerated remediation timelines? What evidence would demonstrate whether an attacker exploited these vulnerabilities before you patched them?
The challenge isn't just technical. It's organizational. BOD 26-04 requires coordination between asset inventory teams, vulnerability scanning operations, incident response, and patch management. When a new KEV entry appears, you're not just scheduling a patch. You're executing a risk-based decision tree that determines remediation priority, investigates potential compromise, and documents your rationale.
The Environment and Constraints
Federal agencies operate under constraints that make rapid remediation complex. You can't just push patches to production systems without change control processes, testing windows, and operational approval. Many agencies run legacy systems where patching requires vendor coordination or extensive compatibility testing. Publicly exposed assets often support mission-critical services where unplanned downtime carries real consequences.
BOD 26-04 acknowledges these realities by focusing requirements on high-risk scenarios: publicly exposed assets where exploitation grants total control. This scoping decision reflects CISA's recognition that federal agencies must balance security urgency against operational stability.
The directive also introduces a new requirement that many agencies weren't prepared for: checking whether threat actors compromised systems before patches were applied. This isn't standard practice in many vulnerability management programs. It requires threat hunting capabilities, log analysis infrastructure, and clear procedures for escalating potential compromises to incident response teams.
The Approach BOD 26-04 Mandates
BOD 26-04 establishes a risk-based framework that federal agencies must follow:
Asset Classification: Identify which assets are publicly exposed and determine whether successful exploitation of a KEV vulnerability would grant total control. This classification drives remediation timelines.
Prioritized Remediation: KEV vulnerabilities on publicly exposed assets that grant total control receive accelerated remediation. Lower-risk scenarios allow agencies to defer action while they address higher-priority vulnerabilities.
Compromise Assessment: For KEV vulnerabilities meeting the high-risk criteria, check for evidence of compromise before the patch was applied. This transforms vulnerability management from a purely preventive control into a detection and response workflow.
Deferral for Lower Risk: The directive explicitly allows deferring remediation of vulnerabilities that don't meet the high-risk criteria, acknowledging that not every CVE warrants immediate action.
When CVE-2026-96951 and CVE-2026-104935 hit the KEV Catalog, agencies following BOD 26-04 immediately assess whether they have publicly exposed Windows systems or Ivanti Connect Secure instances. If those assets exist and meet the control threshold, remediation moves to the front of the queue. If the assets aren't publicly exposed or exploitation wouldn't grant total control, agencies document the risk assessment and proceed with standard patch cycles.
Results and What Federal Agencies Are Learning
BOD 26-04 is still new enough that agencies are refining their implementation approaches. Early lessons from federal vulnerability management teams include:
Asset inventory becomes the foundation: You can't assess whether a KEV vulnerability affects your publicly exposed, high-control assets if you don't have accurate asset inventory data. Agencies are discovering gaps in their Configuration Management Database records and network visibility.
"Total control" requires interpretation: Determining whether exploitation grants total control isn't always straightforward. Agencies are developing internal guidance to make consistent decisions across different vulnerability types and system architectures.
Compromise checking requires new capabilities: Many agencies lack the log retention, SIEM configuration, or threat hunting skills to effectively check for pre-patch exploitation. This gap is driving investments in security operations capabilities.
Documentation matters for audit: When you defer remediation of a KEV vulnerability because it doesn't meet the high-risk criteria, you need clear documentation of that decision. Inspectors General and audit teams will review these risk assessments.
What Agencies Would Do Differently
If federal agencies could restart their BOD 26-04 implementation, most would focus on three areas:
Build the asset inventory first: Trying to implement risk-based vulnerability management without accurate asset inventory data creates constant friction. Start with network discovery, asset classification, and exposure mapping before the first KEV entry requires a decision.
Define "total control" criteria in advance: Don't wait until a KEV entry forces the question. Develop internal guidance that defines what "total control of the asset post-exploitation" means for different system types, vulnerability classes, and network positions.
Test your compromise detection capabilities: Before you're required to check for evidence of exploitation, verify that you have the log sources, retention periods, and analysis tools to actually perform that assessment. Many agencies discovered capability gaps only when a KEV entry triggered the requirement.
Takeaways for Your Team
If you're outside the Federal Civilian Executive Branch, BOD 26-04 doesn't legally bind you. But CISA explicitly encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
The framework BOD 26-04 establishes makes sense for defense contractors, state agencies, and critical infrastructure operators. Instead of chasing every CVE based on CVSS scores, you focus remediation resources on vulnerabilities that threat actors are actively exploiting. The KEV Catalog becomes your priority queue.
You don't need to implement every requirement of BOD 26-04. But consider these elements:
Monitor KEV additions: CISA updates the catalog as evidence of exploitation emerges. Set up notifications so your vulnerability management team sees new entries immediately.
Assess your exposure: When a KEV entry appears, quickly determine whether you run the affected product and whether those instances are publicly exposed. This assessment drives your remediation urgency.
Check for compromise on critical assets: For KEV vulnerabilities affecting your most sensitive systems, don't just patch. Look for indicators that an attacker may have already exploited the vulnerability before you closed the window.
Document your risk decisions: If you defer remediation of a KEV vulnerability because it doesn't affect your environment or doesn't meet your risk threshold, document that decision. Future audits will ask why certain KEV entries weren't immediately addressed.
The addition of CVE-2026-96951 and CVE-2026-104935 to the KEV Catalog represents CISA's ongoing effort to provide actionable threat intelligence to vulnerability management teams. Whether BOD 26-04 applies to your organization or not, those entries signal that threat actors are actively exploiting these vulnerabilities. Your remediation timeline should reflect that reality.
