CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, a list of actively exploited vulnerabilities. A new vulnerability, identified as CVE-2026-42208 affecting BerriAI LiteLLM, has been added due to active exploitation. This vulnerability specifically involves SQL injection, a common attack method. This poses a significant risk to the federal enterprise. The KEV Catalog was created by Binding Operational Directive (BOD) 22-01 to address known exploitable vulnerabilities. BOD 22-01 mandates federal agencies to remediate listed vulnerabilities to protect their networks. Agencies must address these vulnerabilities by specified deadlines. While BOD 22-01 applies to federal agencies, CISA recommends all organizations prioritize KEV remediation. Timely remediation of KEV vulnerabilities is crucial for reducing cyberattack exposure. CISA will continue to update the catalog as new exploitable vulnerabilities are identified.