BOD 26-04 for operators: patch then prove you were not owned

CISA Binding Operational Directive 26-04 (BOD 26-04) extends the scope of the KEV-based patching mandate to require federal agencies not just to patch within the required window, but to demonstrate that no pre-patch compromise occurred on the affected systems. The directive recognises that remediation timelines create a gap: if a vulnerability was exploited before the patch was applied, applying the patch does not undo the intrusion.

For operators engaged against federal agency environments — or any organisation that has adopted BOD-equivalent policies — BOD 26-04 changes what a complete remediation engagement looks like. Patch application is table stakes. The forensic-triage gate is the delivery.

The BOD 26-04 two-step requirement

1. Patch within the KEV window. Federal agencies must remediate KEV-listed CVEs by CISA's required remediation date. For the October 2026 KEV additions, the deadline is 10 Nov 2026.
2. Demonstrate pre-patch posture. Before or concurrent with patching, the agency must document evidence that the vulnerability was not exploited during the exposure window. This requires log review, artifact hunting, and in some cases IR engagement.

The second requirement is where most organisations under-invest. Patching is operationally straightforward. Proving absence of compromise requires log retention, hunt capability, and a structured artifact checklist — none of which can be improvised on deadline day.

Decision tree: patch-only vs. forensic-triage

KEV examples from October 2026 with triage tracks

The 20 Oct 2026 CISA KEV additions illustrate different BOD 26-04 triage postures:

Implication: CVE-2026-110936 (Siemens) can be handled as patch-only for most federal workstation environments — local access prerequisites mean the pre-patch exposure window for remote attackers is narrow. CVE-2026-96652 (Plex SSRF) requires log review before sign-off if the service was internet-facing during the exposure window.

Forensic-triage artifact checklist

For internet-facing vulnerabilities, the triage before patching:

Plex Media Server (CVE-2026-96652 through CVE-2026-96656)

# Plex access log location (Linux)
~/.config/Plex/Logs/Plex Media Server.log

# Look for unexpected outbound fetch destinations
grep -E "metadata|fetch|http://" ~/.config/Plex/Logs/*.log | \
    grep -vE "thetvdb|themoviedb|music.plex.tv|metadata.provider.plex.tv"

# Check plug-in directory for unexpected files
ls -la ~/Library/Application\ Support/Plex\ Media\ Server/Plug-ins/
# Linux: /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Plug-ins/

# Process audit for unexpected Plex child processes
# (from SIEM / EDR; Plex should not spawn bash, sh, python, curl as direct children)

SiteGuard WAF (CVE-2026-106931)

Operator deliverable framing

For engagements where BOD 26-04 compliance is in scope, structure the deliverable as two gates:

1. Forensic triage gate: artifact review for each internet-facing KEV entry; conclusion: "no evidence of exploitation found" or "IR escalation required"
2. Patch verification gate: confirmed fix version installed; documented date and method

Neither gate substitutes for the other. An environment with all KEV patches applied but no forensic review does not satisfy BOD 26-04. An environment with a clean forensic review but unpatched systems also fails. The combined deliverable is the sign-off.