BOD 26-04 Calculator

Look up one combination

BOD 26-04 sets how fast federal agencies must remediate a vulnerability from four inputs. Whether an asset is publicly exposed depends on your network, not on the CVE, so you supply it; the other three can be filled from the CISA assessment for any CVE this site tracks.

Publicly exposed

In the KEV catalog

Automatable by adversary

Technical impact

Check a list of CVEs

CVE IDs (any separators)

Treat these assets as

Automatable and technical impact come from CISA's Vulnrichment assessment. Where one is missing, CISA's defaults apply: automatable is "no" unless the CVE is in KEV, and technical impact is "total". A * marks a value assumed that way. CVEs this site does not track are listed as unknown. Days are calendar days; the clock starts when CISA adds the CVE to KEV, or when the agency identifies it on an asset. Agencies make the final exposure call asset by asset and may set shorter timelines.

Table 1, as published

#	Exposed	In KEV	Automatable	Impact	Timeline

Transcribed from Appendix A of BOD 26-04 (issued 2026-06-10), which replaced BOD 22-01. Implementation guidance.