CISA has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These newly identified vulnerabilities are actively being exploited and pose significant risks. The affected products include multiple Check Point products, Arista VeloCloud Orchestrator, and F5 BIG-IP APM. Specifically, the vulnerabilities involve improper certificate validation, path traversal, improper input validation, and heap-based buffer overflows. These types of exploits are common tools for cyber attackers. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. The directive emphasizes addressing vulnerabilities on publicly exposed assets that grant full control after exploitation. BOD 26-04 also outlines requirements for checking if systems were compromised before patching. While BOD 26-04 specifically targets federal agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to update the KEV Catalog with vulnerabilities that meet the exploitation criteria. Organizations can submit potential candidates for the KEV Catalog via CISA's nomination form if they have a CVE ID, proof of exploitation, and mitigation details.