CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These include vulnerabilities in PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE SMA, Synacor Zimbra, and Cisco Catalyst SD-WAN Manager. These types of vulnerabilities are common attack vectors and present significant risks. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to identify vulnerabilities posing a substantial risk to the federal enterprise. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies fix these vulnerabilities by a specified deadline. This action aims to protect FCEB networks from active cyber threats. While BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to address KEV Catalog vulnerabilities promptly. Prioritizing remediation is crucial for reducing cyberattack exposure. CISA will continue to update the KEV Catalog with new vulnerabilities that meet the established criteria.