BOD 26 04
9 articles tagged “BOD 26 04”.
-
WordPress CVE-2026-119977: When the Upgrade Is the Risk
CISA's WordPress KEV entry is due Nov 6 and the exposure sits in the upgrade itself. How to scope, triage and run the core update as an emergency change.
-
php2shell KEV Deadline: Evidence First, Then the Emergency Patch
CISA's php2shell KEV entries are due Oct 29 and flagged for forensic triage. How to run the emergency change: collect evidence, patch, restart, verify.
-
Ivanti Connect Secure CVE-2026-104935: Patching Is Not Recovery
CVE-2026-104935 hit Ivanti Connect Secure with a 3-day KEV deadline, a missed integrity check and an unpatched third bug. A change plan beyond the patch.
-
Zammad KEV: When Your Helpdesk Becomes the Breach Path
CISA added two Zammad flaws to KEV after a breach at DIVD. What the chain exposes, why the vendor and CSIRT disagree, and how to treat your helpdesk.
-
This Week in Change Risk — Week of Aug 24, 2026
A CVSS-10.0 Oracle flaw with CISA's tightest three-day deadline, six more KEV entries, GitHub's outage pledge, and PagerDuty's SRE-agent drop.
-
BOD 26-04: Pre-Wire Your Emergency Change Before the Clock
CISA's BOD 26-04 sets a 16-row deadline table. Here is how a CAB pre-authorizes the ECAB so a 3-day KEV clock never catches you improvising.
-
The 3-Day KEV Clock: A CAB Runbook for CVE-2026-8037
CISA gave Progress LoadMaster CVE-2026-8037 a three-day deadline. How a change advisory board runs an emergency change against that clock.
-
CISA BOD 26-04: Risk-Based Patch Deadlines for CABs
CISA BOD 26-04 replaces the flat 14-day KEV clock with 3, 14, and 60-day risk-based deadlines. What change managers and CABs must rebuild by December.
-
CISA's July 21 KEV Batch: How a CAB Should Triage 4 CVEs
CISA added four exploited CVEs on July 21, 2026 — WordPress, Langflow, and DD-WRT. A change manager's triage playbook under the new BOD 26-04 rules.