How to actually prioritize vulnerability risk

BOD 26-04: the end of “patch everything above 7.0”

The CISA directive of June 10, 2026 replaced BOD 19-02 (CVSS-based remediation) and BOD 22-01 (the KEV catalog). Instead of a number it asks four binary questions you have to answer for each vulnerability:

• Is the asset publicly exposed?
• Is the CVE in the KEV catalog? (over 1,300 entries as of June 2026)
• Can exploitation be fully automated? (Automatable)
• Does the attacker gain partial or total control? (Partial / Total control)

Four variables give sixteen combinations and five deadline tiers: 3 days with a mandatory post-incident check, 3 days, 14 days, 60 days, and “fix at the next system update.” The harshest case, KEV plus full asset takeover, calls for more than a patch. You also have to check whether the system is already compromised.

Note two things. First, the deadlines are dynamic: pulling an asset off the internet changes its “publicly exposed” value and shifts the deadline. Second, the model cuts the urgent list hard. In a CISA analysis at a large civilian agency only 1% of vulnerability instances landed in the three-day tier, and more than 60% could wait for the next update.

“That’s a US directive” - and it still applies to you

BOD 26-04 binds US federal agencies. What binds you is different: the amendment to the National Cybersecurity System Act of January 23, 2026 (Journal of Laws 2026 item 252), which took effect on April 3, 2026 and wrote the NIS2 directive into Polish law. The timeline is specific:

• October 3, 2026: application to join the register after a self-assessment (the S46 system).
• April 3, 2027: an information security management system and the chapter 3 obligations in place.
• April 3, 2028: the first audit for essential entities.

Penalties run to 10 million EUR or 2% of turnover, with a two-year grace period before they can be imposed, and liability reaches management personally too. Two items in the Article 21(2) NIS2 catalog hit this article’s topic directly: “vulnerability handling and disclosure” and procedures to assess how effective your risk-management measures are, which means pentests and audits among them.

And here is the problem BOD 26-04 solves for free. Neither NIS2 nor the KSC act tells you how to prioritize. You will not find a CVSS threshold or a list of deadlines in them. You have to define, document, and defend your own method, and that is exactly the document an auditor will ask for.

Picture the question: why did this vulnerability wait eight months? The answer “because it scored 5.3 in CVSS” sounds like an excuse. The answer “because the asset was not publicly exposed, the CVE was not in KEV, and the impact was partial, per our prioritization policy based on CISA BOD 26-04 and SSVC” sounds like risk management. Adopting the US directive is the cheapest way to give your own process a recognized pedigree, without waiting for someone in Warsaw or Brussels to publish a Polish version.

CVSS, EPSS, SSVC: each answers a different question

Three acronyms, three very different jobs. The mistake starts when you try to swap one for another.

CVSS v4.0 answers: how dangerous is this hole in isolation? It is a technical baseline. It helps to know what changed from v3.1. The Temporal group became Threat, Scope gave way to a split between Vulnerable System and Subsequent System, and scores are reported as CVSS-B, CVSS-BT, CVSS-BE, or CVSS-BTE. Impact metrics take High, Low, or None values. The terms Total and Partial control come from SSVC, not CVSS.

EPSS v4 (March 2025) answers: what is the probability of exploitation within 30 days? It is a machine-learning model fed CVE metadata and threat-intelligence signals from many feeds. The numbers are striking: remediating at an EPSS threshold of 0.1 means dealing with 2.7% of vulnerabilities and covers 63.2% of the ones actually exploited. FIRST itself warns that EPSS does not know your environment and cannot be the only criterion.

SSVC answers: what should I do about it here? Instead of a number you get a decision: Act (immediate coordinated response), Attend (faster than the standard maintenance window), Track* (closer monitoring, fix in the standard window), Track (standard window). Those SSVC decision points, Automatable and Technical Impact, are the backbone of BOD 26-04.

Commercial systems: convenience versus the black box

Tenable (VPR), Qualys (TruRisk), and Rapid7 (Active Risk) do what you would do by hand, only faster: they combine CVSS, EPSS, KEV, and network activity data into a single score. The gain can be real. Tenable reports that CVSS flags about 60% of vulnerabilities as high or critical, while its new-generation VPR narrows the field to 1.6%.

The price for that convenience is limited transparency. You will rarely learn why a score jumped from 4 to 8. Treat these tools as an early-warning system, not an oracle.

The attacker’s view: why a Medium can be the golden ticket

A pentester is not hunting for one critical flaw. We hunt for a path. Vulnerabilities labeled Medium are often the most valuable to us, because they fit a chain of attack perfectly.

Back to the missing SMB signing. Nessus classes it as Medium (plugin 57608, CVSS 5.3), and fairly so, since the flaw itself reveals nothing. The problem is what you can build on it. It helps to separate two different attacks that often get lumped together:

• NTLM relay: the attacker poisons LLMNR/NBT-NS/mDNS, captures an authentication attempt, and relays it onward to a server without SMB signing. They authenticate as the victim without knowing or cracking the password. This is technique T1557.001 in MITRE ATT&CK.
• Offline cracking: instead of relaying the authentication, you save the NetNTLMv2 hash and crack it locally. Here the password does fall, but only if it is weak.

On top of that, tools like PetitPotam and Coercer force authentication (T1187), so you do not even have to wait patiently for traffic on the wire.

# 1. Wytypowanie hostów bez wymuszonego podpisywania SMB
nxc smb 10.10.0.0/24 --gen-relay-list unsigned_hosts.txt

# 2. Tryb relay: NAJPIERW w Responder.conf ustaw SMB = Off oraz HTTP = Off,
#    inaczej Responder zajmie porty potrzebne ntlmrelayx
sudo responder -I eth0 -v

# 3. W drugim terminalu - przekazanie uwierzytelnienia (bez znajomości hasła)
sudo ntlmrelayx.py -tf unsigned_hosts.txt -smb2support -i

# 4. Ścieżka alternatywna: łamanie przechwyconego hasha NetNTLMv2 offline
hashcat -m 5600 hashes.txt rockyou.txt

To be fair: Windows 11 24H2 requires SMB signing in both directions, and Windows Server 2025 enforces it on the client side. If your environment is uniform and current, this particular vector narrows. The catch is that almost no one has an environment like that. You are left with NAS boxes, Samba on Linux, OT devices, legacy systems, and LDAP relay, which SMB signing alone does not stop.

Business impact: why the response window closed

The market data explains CISA’s hurry. Per the Verizon DBIR 2025, vulnerability exploitation accounts for 20% of breaches (up 34% year over year), and the share of edge devices and VPNs jumped from 3% to 22%. The median time to remediate those devices is 32 days, against a median time from disclosure to mass exploitation of zero days.

Google Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025, with a record share in enterprise technology. The average time-to-exploit fell from 63 days in 2018 to a negative value: exploitation now runs ahead of the patch. A quarterly patch cycle simply does not work in that reality.

Recommendations: how to run remediation in practice

You will not fix everything, and you should not try. Focus here:

• Bring the BOD 26-04 model in-house. The four questions (exposure, KEV, automatability, scope of takeover) are a ready-made, free decision framework. Full rollout across US agencies is due from December 2026, so you have time to get ahead of the market.
• Write it down as policy, not habit. If you are an essential or important entity, by April 3, 2027 you need a documented vulnerability-handling procedure. A method built on KEV, exposure, and technical impact is easier to defend to an auditor than a table of CVSS thresholds.
• Tag your assets before you tag vulnerabilities. The model falls apart without reliable information on what is exposed to the world and what is business-critical. This is usually the hardest and most rewarding stage.
• Use EPSS as a filter, not a verdict. A 0.1 threshold clears most of the noise for little effort, but EPSS does not know your printer has domain-admin credentials saved on it.
• Enforce SMB signing and restrict NTLM. Set-SmbServerConfiguration -RequireSecuritySignature $true, and over time move toward Kerberos and disable NTLM where you can.
• Map attack chains, not just flaws. A pentest shows which Medium in your specific network is critical in practice, something no scanner can compute.

Hard data (KEV, EPSS, CVSS) tells you what is dangerous in the world. What is dangerous in your environment is known only to someone who knows your architecture: you, or an experienced pentester.