WORLDTECHCISA Adds Six Exploited security flaws to KEV Catalog Under New Directive
The US Cybersecurity and Infrastructure Security Agency (CISA) has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence that attackers are actively exploiting them. The additions come alongside Binding Operational Directive 26-04, which sets stricter priorities for how federal agencies fix flaws.
Six vulnerabilities added to the catalog
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog. The agency includes a flaw in the catalog only when there is evidence that it is being actively exploited, which is the basis for the six additions announced on October 20, 2026.
CISA says it will keep adding vulnerabilities to the catalog as they meet its criteria.
What the new directive requires of federal agencies
Binding Operational Directive 26-04, titled Prioritizing Security Updates Based on Risk, sets vulnerability management requirements for Federal Civilian Executive Branch agencies. Under it, agencies must give rapid attention to high-risk vulnerabilities listed in the catalog, specifically those on publicly exposed assets that would give an attacker total control of the asset once exploited. Lower-risk vulnerabilities may be deferred.
The directive also sets basic expectations for when agencies must check whether threat actors compromised a system before the relevant patch was applied.
Scope beyond federal agencies
The directive applies only to federal civilian agencies. CISA nonetheless encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing the vulnerabilities listed in the KEV Catalog.
Open questions
- Which six vulnerabilities were added, and which products they affect?
- How many agencies must meet the new expectations, and by when?