CISA has added a new vulnerability, CVE-2026-21589 affecting Atlassian products, to its Known Exploited Vulnerabilities Catalog. This vulnerability allows external parties access to files or directories, representing a common and significant risk. Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize security updates for high-risk vulnerabilities. Specifically, BOD 26-04 requires agencies to focus on vulnerabilities listed in the KEV Catalog that are on public-facing assets, grant total control post-exploitation, and have clear mitigation strategies. The directive also sets expectations for agencies to check for compromises before applying patches. Although BOD 26-04 applies only to FCEB agencies, CISA strongly recommends all organizations implement risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and meet the criteria. Organizations can nominate vulnerabilities not yet on the catalog for review if they possess a CVE ID, evidence of exploitation, and available mitigation guidance. This proactive approach aims to enhance overall cybersecurity resilience.