BOD 26-04: three days to patch, and a harder question underneath

In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) rewrote how federal agencies handle their worst vulnerabilities. The inference here is that Binding Operational Directive (BOD) 26-04 denotes a faster patch clock. That is probably the wrong way to look at it.

The directive's highest-risk tier comes with three days to remediate and a requirement most people skip past: forensic triage. Agencies have to determine whether a system was already compromised before the patch arrived. The directive binds Federal Civilian Executive Branch agencies, and agencies must extend the same expectations to the contractors who operate their systems.

For a generation of directives, compliance meant one thing. Did you patch in time? BOD 26-04 adds a harder one:

Were you breached while you waited?

For the most dangerous flaws, patching speed alone is no longer the answer. And the new question takes something many Enterprise Linux systems do not have: a continuous view of the kernel at runtime.

BOD 26-04 sorts vulnerabilities by how much control is surrendered

The old directives treated the catalog as a flat list. Patch the Known Exploited Vulnerabilities (KEV) list, hit the deadline, repeat. BOD 26-04 throws a bit of a curve-ball and scores each flaw, in rising order of consequence.

1. Is the asset publicly exposed?
2. Is it in the KEV catalog, meaning CISA has confirmed real-world exploitation?
3. Can the exploit be automated and fired at every host at once?
4. What does it hand the attacker: partial control, or total control of the machine?

A flaw that answers yes to all four reaches the directive's top tier: a publicly exposed, actively exploited, fully automatable flaw that hands over total control.

The clock is three days, and it comes with the forensic triage requirement.

"The text '& forensic triage' means that the agency must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised."

— CISA, Binding Operational Directive 26-04, Appendix A

Remediation alone no longer closes a top-tier item. CISA added the triage step because, for this class of flaw, exploitation often precedes the patch.

Neutralize a flaw months before the patch ships

The fix for CVE-2025-4598 shows how long the window can stay open.

CVE-2025-4598 is a flaw in systemd-coredump, the default core-dump handler on Enterprise Linux 9. A local user can race it and walk off with password hashes and cryptographic keys from privileged processes, including OpenSSH host keys. By CISA's own definition, an exploit that reliably reveals log-in credentials is total control, the worst answer to the directive's fourth question. That is the profile BOD 26-04 puts on its shortest clocks. Trivially exploitable. Qualys disclosed it in May 2025. The upstream fix did not land until December. For half a year, every standard Enterprise Linux system carried a known, weaponizable hole and no patch to close it.

RLC Pro Hardened closed it on day one, three ways, with no patch at all:

• Disabled core dumps on the affected privileged processes, shutting the primary path.
• Restricted unprivileged access to the set-user-ID programs the exploit chains through.
• Hashed local passwords with yescrypt, so any leaked secret was orders of magnitude harder to crack.

In testing, the attack failed continuously. Then the team turned off the primary defense on purpose. The other two layers held.

The clock starts at disclosure. The patch arrives when it arrives. The only thing in between is what you hardened before anyone knew the hole was there. CIQ broke down all three layers in its analysis of CVE-2025-4598.

A patch closes the hole. It can't tell you who already walked through it.

Standard Enterprise Linux has no eyes inside the kernel at runtime. It can patch a kernel flaw once the fix ships. It cannot watch one being exploited in the meantime.

RLC Pro Hardened ships Linux Kernel Runtime Guard (LKRG), and no other Enterprise Linux distribution includes it. LKRG validates kernel integrity continuously and catches exploitation as it happens with near-zero false positives. This has been tested: it detected live kernel exploits including CVE-2024-1086 and CVE-2021-3490, the latter demonstrated on stage at Nullcon Berlin. An independent academic review (University of Oulu master's thesis benchmarking five Linux rootkit detectors) rated LKRG the most effective of the tools tested at detecting kernel rootkits.

When the patch is late and the exploit is early, LKRG turns "we have no idea" into a logged, time-stamped event.

Turn "we don't know" into an audit-ready timeline

BOD 26-04's top tier does not stop at remediation. It requires forensic triage: determine whether the system was compromised before the patch landed. A question you could once defer is now on a three-day clock.

On standard Enterprise Linux, the standard kernel-level answer is usually "we don't know," because nothing was watching.

LKRG was already watching. Its integrity checks record when a kernel structure, credential, or control path is tampered with, and stream those events, encrypted, to your Security Information and Event Management (SIEM) platform. When the auditor asks whether you were breached during the window, you have an auditable timeline.

Hardening designed by a leading expert

None of this is a Security Technical Implementation Guide (STIG) script run once and forgotten. RLC Pro Hardened was architected by Alexander Peslyak, known as Solar Designer, who wrote the first return-to-libc and generic heap-overflow exploits. Its defenses target the paths real attackers use, because the person who built them used those paths first.

And it arrives compliant: FIPS 140-3 validated cryptography, CAVP-certified post-quantum algorithms, and up to 95% DISA STIG applied out of the box. You do not choose between hardened and audit-ready.

BOD 26-04 did not raise the bar on how fast you patch. It changed what counts as an answer. RLC Pro Hardened is built for the question CISA is actually asking now.

If you are building the case internally, the RLC Pro Hardened technical brief lays out the full hardening and compliance picture in a form you can take to your security team.