What is the FedRAMP vulnerability remediation timeline?

FedRAMP sets the time to mitigate or remediate a vulnerability per certification class, Potential Agency Impact N-rating (PAIN) and exposure, counted from the evaluation (VDR-TFR-PVR, SHOULD). For an internet-reachable, likely exploitable N5 vulnerability the time to bring it to a lower rating is Classes A and B 4 days, Class C 2 days, Class D 12 hours. For a not likely exploitable N2 vulnerability it is 192 days in every class. N1 has no timeframe in the rules. Known Exploited Vulnerabilities follow CISA's due dates instead (VDR-TFR-KEV).

What replaced the 30, 90 and 180-day remediation SLAs?

The 2026 Consolidated Rules do not set remediation deadlines by scanner severity. VDR-TFR-PVR sets them by the vulnerability's PAIN rating (N0 to N5, VER-EVA-EPA), internet reachability (VER-EVA-EIR) and likely exploitability (VER-EVA-ELX), counted from the evaluation rather than from the scan. VER-TFR-EVU sets the time to evaluate (Class A within 14 days (SHOULD), Class B within 7 days (SHOULD), Class C within 5 days (SHOULD), Class D within 2 days (SHOULD) of detection), and VER-TFR-MAV marks anything still open 192 days after evaluation as an accepted vulnerability. The rules apply to 20x and Rev5 from 7 December 2026.

Do Rev5 providers have to follow VDR and VER?

Yes. FedRAMP lists the VDR and VER rules for 20x and Rev5 certifications on the Program and Agency paths, Classes B, C and D, and both become mandatory for obtaining and maintaining a certification on 7 December 2026 (status: Mandated by CISA BOD 26-04). The grace period ends on 7 March 2027. One rule differs: Rev5 providers verify and validate machine-based resources under VDR-TFR-MVF (Class B every month (SHOULD), Class C every month (MUST), Class D every month (MUST)); 20x providers under VDR-TFR-MVX (Class A every month (SHOULD), Class B every 7 days (MUST), Class C every 3 days (MUST)).

What is a PAIN rating?

PAIN is the Potential Agency Impact N-rating: the provider's estimate of the likely impact of exploitation on the agencies that use the cloud service, assigned to every detected vulnerability (VER-EVA-EPA, MUST). The levels: N0, Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering; N1, Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering; N2, Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering; N3, Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering; N4, Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering; N5, Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering. The rating, with internet reachability and likely exploitability, selects the remediation timeframe in VDR-TFR-PVR.

What happens after 192 days?

VER-TFR-MAV (MUST): a vulnerability that is not, or will not be, fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability. Accepted vulnerabilities are reported with the information in VER-RPT-AVI, including the reason they are accepted, and agencies review them under their own policies. Before that, a vulnerability past its VDR-TFR-PVR timeframe is an overdue vulnerability, which the monthly report must flag and explain.

What counts as internet-reachable?

FedRAMP's definition (FRD-IRV): A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet. VER-EVA-EIR (MUST) requires providers to evaluate every detected vulnerability for internet reachability in the context of the service. FedRAMP's notes on that rule stress "reachable" rather than "accessible": a resource behind a load balancer or firewall can still process a payload that originated on the internet, with SQL injection and Log4Shell as the examples. A payload that is intercepted, filtered or rejected before it reaches the vulnerable resource makes the vulnerability no longer internet-reachable.

20x and Rev5 · Classes B, C and D

FedRAMP VDR and VER Timelines by Class (2026 Rules)

Every deadline in FedRAMP's Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules, read from FedRAMP's rules file at build time: how fast to evaluate a vulnerability, how long you have to fix it by class and rating, how often to detect, verify and report, when a vulnerability becomes accepted, and what Known Exploited Vulnerabilities change.

FedRAMP release 2026.10.13.01Rules last changed 2026-10-13Checked against FedRAMP/rules 2026-10-30

This page as JSON, same data, for scripts and agents.

Who these rules apply to, and from when

The VDR and VER rules apply to 20x and Rev5 certifications on the Program and Agency paths, Classes B, C and D. FedRAMP's status for both: Mandated by CISA BOD 26-04.

Providers obtaining or maintaining a certification must follow them from 7 December 2026. Optional adoption has been allowed since 4 July 2026. The grace period ends on 7 March 2027. Until then, a provider that is not yet following them may keep its certification under a corrective action plan, with notice to every agency customer; after that date FedRAMP revokes the certification of offerings that do not follow these rules (NTC-0014).

Class A. FedRAMP lists these rules for Classes B, C and D. A Class A provider owes only the VDR and VER rules that the Class A certification rules pull in: VDR-CSO-DET (FRC-CLA-MFR, MUST); VDR-TFR-MVX, VDR-TFR-PCD, VDR-TFR-PDD, VDR-TFR-PSD, VDR-TFR-PVR, VER-TFR-EVU (FRC-CLA-RFR, SHOULD); VER-TFR-IRI, VER-TFR-MRH, VER-TFR-NRI (FRC-CLA-OFR, MAY). The rules file does not say whether those follow the Class A dates (obtain 4 July 2026, maintain 1 January 2027) or 7 December 2026. This page shows Class A rows wherever FedRAMP publishes them.

The sequence, from detection to acceptance

One vulnerability moves through these steps. Each row names the rule, its force (MUST, SHOULD or MAY, as FedRAMP writes it) and the clock it starts.

Step	Rule	Force	Clock
01 Detect the vulnerability	`VDR-CSO-DET` Vulnerability Detection	MUST	Persistently, at the detection cadences below
02 Evaluate it within the window	`VER-TFR-EVU` Evaluate Vulnerabilities Quickly	SHOULD	A 14 days, B 7 days, C 5 days, D 2 days from detection
03 Decide internet reachability, likely exploitability and the PAIN rating	`VER-EVA-EIR` Evaluate Internet-Reachability `VER-EVA-ELX` Evaluate Exploitability `VER-EVA-EPA` Estimate Potential Agency Impact `VER-EVA-AIA` Assume It's Automatable	MUST MUST MUST MUST	Part of the evaluation; assume exploitation can be automated
04 Mitigate or remediate within the matrix	`VDR-TFR-PVR` Mitigation and Remediation Expectations	SHOULD	From evaluation, by PAIN rating, reachability and exploitability
05 Treat it as a FedRAMP Reportable Incident above the thresholds	`VER-TFR-IRI` Internet-Reachable Incidents `VER-TFR-NRI` Non-Internet-Reachable Incidents	A MAY · B MAY · C SHOULD · D SHOULD A MAY · B MAY · C MAY · D SHOULD	While the rating stays above N3 (reachable) or at N5 (not reachable)
06 Report it and keep the machine-readable history	`VER-TFR-MHR` Monthly Activity Report `VER-TFR-MRH` Historical Activity	MUST A MAY · B SHOULD · C SHOULD · D SHOULD	Report at least every month; A 1 month, B 1 month, C 14 days, D 7 days for the JSON history
07 Mark it accepted if it is still open	`VER-TFR-MAV` Mark Accepted Vulnerabilities	MUST	192 days from evaluation
08 Remediate Known Exploited Vulnerabilities by CISA's dates	`VDR-TFR-KEV` Remediate KEVs	SHOULD	The due date in CISA's KEV catalog

Evaluation windows, from detection

After VDR-CSO-DET (MUST) finds a vulnerability, VER-TFR-EVU (SHOULD) sets the time to complete the evaluation the VER-EVA rules require. The evaluation decides three things, each a MUST: is it an internet-reachable vulnerability (IRV) (VER-EVA-EIR), is it a likely exploitable vulnerability (LEV) (VER-EVA-ELX), and what is its Potential Agency Impact N-rating (PAIN), N0 to N5 (VER-EVA-EPA). Providers must assume exploitation can be automated unless they can prove otherwise (VER-EVA-AIA).

VER-TFR-EVU: evaluate all vulnerabilities within this time of detection
Class	Force	Evaluate within
Class A	SHOULD	14 days of detection
Class B	SHOULD	7 days of detection
Class C	SHOULD	5 days of detection
Class D	SHOULD	2 days of detection

The PAIN levels, as `VER-EVA-EPA` defines them

N0: Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering.
N1: Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering.
N2: Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering.
N3: Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering.
N4: Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering.
N5: Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering.

Remediation timeframes, from evaluation

VDR-TFR-PVR (SHOULD) gives the time, counted from the evaluation, to partially mitigate, fully mitigate or remediate a vulnerability to a lower PAIN rating. The time depends on the current PAIN rating, on whether the vulnerability is internet-reachable, and on whether it is likely exploitable. The columns: internet-reachable and likely exploitable (IRV + LEV); not internet-reachable but likely exploitable (NIRV + LEV); not likely exploitable (NLEV), whether reachable or not.

The timeframes run from the evaluation. The rule says nothing about restarting the clock after a partial mitigation, so this page does not assume it. In the words of FedRAMP's definitions, a partially mitigated vulnerability has a reduced likelihood or rating, a fully mitigated vulnerability has negligible risk but is still detected, and a remediated vulnerability is gone.

Classes A and B SHOULD

VDR-TFR-PVR, Classes A and B: time from evaluation to bring the vulnerability to a lower PAIN rating
PAIN rating	Internet-reachable and likely exploitable (IRV + LEV)Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not internet-reachable, likely exploitable (NIRV + LEV)Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not likely exploitable (NLEV)Not Likely Exploitable Vulnerability
N5	4 days	8 days	32 days
N4	8 days	32 days	64 days
N3	32 days	64 days	192 days
N2	96 days	160 days	192 days
N1	No timeframe in the rules

Class C SHOULD

VDR-TFR-PVR, Class C: time from evaluation to bring the vulnerability to a lower PAIN rating
PAIN rating	Internet-reachable and likely exploitable (IRV + LEV)Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not internet-reachable, likely exploitable (NIRV + LEV)Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not likely exploitable (NLEV)Not Likely Exploitable Vulnerability
N5	2 days	4 days	16 days
N4	4 days	8 days	64 days
N3	16 days	32 days	128 days
N2	48 days	128 days	192 days
N1	No timeframe in the rules

Class D SHOULD

VDR-TFR-PVR, Class D: time from evaluation to bring the vulnerability to a lower PAIN rating
PAIN rating	Internet-reachable and likely exploitable (IRV + LEV)Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not internet-reachable, likely exploitable (NIRV + LEV)Not Internet-Reachable Vulnerability + Likely Exploitable Vulnerability	Not likely exploitable (NLEV)Not Likely Exploitable Vulnerability
N5	12 hours	1 day	8 days
N4	2 days	8 days	32 days
N3	8 days	16 days	64 days
N2	24 days	96 days	192 days
N1	No timeframe in the rules

Detection and verification cadences, by class

How often FedRAMP expects detection and verification to run. Complete detection covers resources that are not likely to drift; drift detection covers those that are; sample detection covers representative samples of similar machine-based resources. Machine verification has one rule for 20x and one for Rev5.

Rule	Class A	Class B	Class C	Class D
`VDR-TFR-PCD`Persistently Complete Detection	every 6 monthsSHOULD	every 6 monthsSHOULD	every monthSHOULD	every monthSHOULD
`VDR-TFR-PDD`Persistent Drift Detection	every 3 monthsSHOULD	every monthSHOULD	every 14 daysSHOULD	every 7 daysSHOULD
`VDR-TFR-PSD`Persistent Sample Detection	every 14 daysSHOULD	every 7 daysSHOULD	every 3 daysSHOULD	every daySHOULD
`VDR-TFR-MVX`Persistent Machine Verification and Validation for 20x · 20x only	every monthSHOULD	every 7 daysMUST	every 3 daysMUST	Not publishedsee note
`VDR-TFR-MVF`Persistent Machine Verification and Validation for Rev5 · Rev5 only	Not published	every monthSHOULD	every monthMUST	every monthMUST
`VDR-TFR-NMV`Non-Machine Verification and Validation	every 3 monthsMUST (every class)

Note. Release 2026.10.13.01 publishes no Class D entry for VDR-TFR-MVX. RFC-0036, FedRAMP's Class D pilot proposal, proposes verification at least once every 3 days for 20x Class D, the same as Class C. This page shows the published number as soon as FedRAMP adds it to the rules file.

Reporting

VER-TFR-MHR (MUST): report vulnerability detection and response activity to all necessary parties in a consistent, human-readable format at least every month. VER-TFR-MRH adds a machine-readable history in JSON, updated by class:

VER-TFR-MRH: Historical Activity
Class	Force	JSON history updated at least
Class A	MAY	every month
Class B	SHOULD	every month
Class C	SHOULD	every 14 days
Class D	SHOULD	every 7 days

`VER-RPT-VDT` MUST

Vulnerability Details: what each report must include.

Provider's internally assigned tracking identifier
Time and source of the detection
Time of completed evaluation
Is it an internet-reachable vulnerability or not?
Is it a likely exploitable vulnerability or not?
Historically and currently estimated Potential Agency Impact N-rating of exploitation
Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating
Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating
Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.
Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability
Final disposition of the vulnerability

`VER-RPT-AVI` MUST

Accepted Vulnerability Info: what each report must include.

Provider's internally assigned tracking identifier
Time and source of the detection
Time of completed evaluation
Is it an internet-reachable vulnerability or not?
Is it a likely exploitable vulnerability or not?
Currently estimated Potential Agency Impact N-rating
Explanation of why this is an accepted vulnerability
Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability

FedRAMP's JSON schemas for these reports: FedRAMP Vulnerability Detail Report (VER-RPT-VDT); FedRAMP Accepted Vulnerability Info (VER-RPT-AVI); FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH).

When a vulnerability is also an incident

Two rules say when an open vulnerability counts as a FedRAMP Reportable Incident, which starts the incident reporting rules. VER-TFR-IRI: an internet-reachable, likely exploitable vulnerability with a PAIN rating above N3, until it is partially mitigated to N3 or below. VER-TFR-NRI: a likely exploitable vulnerability that is not internet-reachable, at N5, until it is partially mitigated to N4 or below. The force depends on the class:

Rule	Class A	Class B	Class C	Class D
`VER-TFR-IRI`Internet-Reachable Incidents	MAY	MAY	SHOULD	SHOULD
`VER-TFR-NRI`Non-Internet-Reachable Incidents	MAY	MAY	MAY	SHOULD

The 192-day rule, and Known Exploited Vulnerabilities

VER-TFR-MAV (MUST): a vulnerability that is not, or will not be, fully mitigated or remediated within 192 days of evaluation is an accepted vulnerability, and must be reported as one, with the reason, under VER-RPT-AVI. A vulnerability past its matrix timeframe but inside that window is an overdue vulnerability.

VDR-TFR-KEV (SHOULD): remediate Known Exploited Vulnerabilities (KEVs) by the due dates in CISA's KEV catalog, even when the vulnerability has been fully mitigated and even when the matrix above would allow longer. FedRAMP ties this to CISA BOD 26-04, which also mandates the VDR and VER rules themselves (Mandated by CISA BOD 26-04).

VDR-TFR-KEV, verbatim
Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.

Deadline calculator

Enter the facts of one vulnerability and get every date the rules set for it: the evaluation deadline from detection, the mitigation or remediation deadline from evaluation, whether it counts as an incident, the day it becomes an accepted vulnerability, and what changes if it is a Known Exploited Vulnerability. The arithmetic runs in your browser on the same data as the tables above.

Program

Certification class

Potential Agency Impact N-rating (PAIN)

Internet-reachable (IRV)?

Likely exploitable (LEV)?

Detected

Evaluation completed

Defaults to the detection time; change it if the evaluation finished later.

Listed in CISA's Known Exploited Vulnerabilities (KEV) catalogThis page does not look the catalog up; check it yourself.

Your deadlines

Evaluate byVER-TFR-EVUSHOULD
Sat 12 Dec 2026
5 days from detection
Mitigate or remediate byVDR-TFR-PVRSHOULD
Wed 9 Dec 2026
2 days from evaluation for N5, internet-reachable and likely exploitable (IRV + LEV); bring it to a lower PAIN rating in that time
Incident treatmentVER-TFR-IRISHOULD
A FedRAMP Reportable Incident until partially mitigated to N3 or below
Accepted vulnerability onVER-TFR-MAVMUST
Thu 17 Jun 2027
192 days from evaluation, unless fully mitigated or remediated first
ReportingVER-TFR-MHRMUST
Goes in the next human-readable activity report
Reports are due at least every month
Machine verification cadenceVDR-TFR-MVXMUST
At least every 3 days

Calendar days, in your local time. The timeframes are what FedRAMP publishes for the class; SHOULD means expected practice, MUST a hard requirement. This is not legal advice.

If you hold a Rev5 authorization

These rules apply to you from 7 December 2026: FedRAMP lists them for 20x and Rev5 alike, on the same dates, with the same timeframes. One rule differs: machine verification. VDR-TFR-MVF is yours (Class B SHOULD every month; Class C MUST every month; Class D MUST every month); VDR-TFR-MVX is for 20x.

How Boundera runs this workflow for Rev5 providers

Questions people ask

What is the FedRAMP vulnerability remediation timeline?: FedRAMP sets the time to mitigate or remediate a vulnerability per certification class, Potential Agency Impact N-rating (PAIN) and exposure, counted from the evaluation (VDR-TFR-PVR, SHOULD). For an internet-reachable, likely exploitable N5 vulnerability the time to bring it to a lower rating is Classes A and B 4 days, Class C 2 days, Class D 12 hours. For a not likely exploitable N2 vulnerability it is 192 days in every class. N1 has no timeframe in the rules. Known Exploited Vulnerabilities follow CISA's due dates instead (VDR-TFR-KEV).VDR-TFR-PVR VDR-TFR-KEV
What replaced the 30, 90 and 180-day remediation SLAs?: The 2026 Consolidated Rules do not set remediation deadlines by scanner severity. VDR-TFR-PVR sets them by the vulnerability's PAIN rating (N0 to N5, VER-EVA-EPA), internet reachability (VER-EVA-EIR) and likely exploitability (VER-EVA-ELX), counted from the evaluation rather than from the scan. VER-TFR-EVU sets the time to evaluate (Class A within 14 days (SHOULD), Class B within 7 days (SHOULD), Class C within 5 days (SHOULD), Class D within 2 days (SHOULD) of detection), and VER-TFR-MAV marks anything still open 192 days after evaluation as an accepted vulnerability. The rules apply to 20x and Rev5 from 7 December 2026.VDR-TFR-PVR VER-EVA-EPA VER-EVA-EIR VER-EVA-ELX VER-TFR-EVU VER-TFR-MAV
Do Rev5 providers have to follow VDR and VER?: Yes. FedRAMP lists the VDR and VER rules for 20x and Rev5 certifications on the Program and Agency paths, Classes B, C and D, and both become mandatory for obtaining and maintaining a certification on 7 December 2026 (status: Mandated by CISA BOD 26-04). The grace period ends on 7 March 2027. One rule differs: Rev5 providers verify and validate machine-based resources under VDR-TFR-MVF (Class B every month (SHOULD), Class C every month (MUST), Class D every month (MUST)); 20x providers under VDR-TFR-MVX (Class A every month (SHOULD), Class B every 7 days (MUST), Class C every 3 days (MUST)).VDR rules VER rules VDR-TFR-MVF VDR-TFR-MVX
What is a PAIN rating?: PAIN is the Potential Agency Impact N-rating: the provider's estimate of the likely impact of exploitation on the agencies that use the cloud service, assigned to every detected vulnerability (VER-EVA-EPA, MUST). The levels: N0, Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering; N1, Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering; N2, Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering; N3, Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering; N4, Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering; N5, Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering. The rating, with internet reachability and likely exploitability, selects the remediation timeframe in VDR-TFR-PVR.VER-EVA-EPA VDR-TFR-PVR Potential Agency Impact
What happens after 192 days?: VER-TFR-MAV (MUST): a vulnerability that is not, or will not be, fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability. Accepted vulnerabilities are reported with the information in VER-RPT-AVI, including the reason they are accepted, and agencies review them under their own policies. Before that, a vulnerability past its VDR-TFR-PVR timeframe is an overdue vulnerability, which the monthly report must flag and explain.VER-TFR-MAV VER-RPT-AVI VDR-TFR-PVR Accepted Vulnerability Overdue Vulnerability
When do VDR and VER become mandatory?: On 7 December 2026, for obtaining and for maintaining a FedRAMP certification, for 20x and Rev5 (status: Mandated by CISA BOD 26-04). Optional adoption has been allowed since 4 July 2026. The grace period runs to 7 March 2027: until then a provider that is not yet following the rules may keep its certification under a corrective action plan, with notice to all agencies; after that date FedRAMP revokes the certification of offerings that do not follow them (FedRAMP notice NTC-0014).VDR rules VER rules NTC-0014
What counts as internet-reachable?: FedRAMP's definition (FRD-IRV): A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet. VER-EVA-EIR (MUST) requires providers to evaluate every detected vulnerability for internet reachability in the context of the service. FedRAMP's notes on that rule stress "reachable" rather than "accessible": a resource behind a load balancer or firewall can still process a payload that originated on the internet, with SQL injection and Log4Shell as the examples. A payload that is intercepted, filtered or rejected before it reaches the vulnerable resource makes the vulnerability no longer internet-reachable.Internet-Reachable Vulnerability (IRV)VER-EVA-EIR
Do CISA KEV due dates override the remediation matrix?: Yes, as a SHOULD. VDR-TFR-KEV (SHOULD): remediate Known Exploited Vulnerabilities according to the due dates in CISA's Known Exploited Vulnerabilities catalog, even when the vulnerability has been fully mitigated, as required by CISA BOD 26-04. The catalog date applies even when the VDR-TFR-PVR matrix would allow longer, and the 192-day rule still applies on top.VDR-TFR-KEV VDR-TFR-PVR Known Exploited Vulnerability (KEV)CISA BOD 26-04

Sources

Every number on this page is read from FedRAMP's rules file, release 2026.10.13.01 (the file at that commit), when the site is built. The rule and glossary links go to Boundera's pages for the same release; the FedRAMP links go to the official text.