CISA has added a new vulnerability, CVE-2026-20182, to its Known Exploited Vulnerabilities (KEV) Catalog. This Cisco Catalyst SD-WAN Controller authentication bypass vulnerability is actively exploited by malicious actors. This type of vulnerability presents significant risks, particularly to federal agencies. CISA urges adherence to Emergency Directive 26-03 and Supplemental Direction ED 26-03 for mitigation, as well as BOD 22-01. The KEV Catalog serves as a list of high-risk vulnerabilities and is a key component of BOD 22-01. Federal agencies must remediate vulnerabilities in the KEV Catalog by their due dates. BOD 22-01 primarily affects federal agencies, but CISA recommends all organizations prioritize KEV Catalog vulnerability remediation. This proactive approach helps reduce exposure to cyberattacks. CISA plans to continue updating the KEV Catalog with vulnerabilities meeting specific criteria.