CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog with a new entry, CVE-2026-73570, an OS Command Injection Vulnerability in Zimbra Collaboration Suite (ZCS). This vulnerability has documented evidence of active exploitation, making its inclusion critical. OS command injection vulnerabilities are frequently targeted by threat actors and present significant risks to organizations, including federal agencies. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the KEV Catalog, requiring rapid remediation of its listed high-risk vulnerabilities on publicly exposed assets that allow full control post-exploitation. BOD 26-04 also sets expectations for agencies to check for prior compromise before applying patches. Although BOD 26-04 applies strictly to FCEB agencies, CISA strongly advises all organizations to adopt a risk-based approach to vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for all entities. CISA will continuously expand the catalog with vulnerabilities meeting its specific criteria. Organizations aware of exploited vulnerabilities not yet listed in the KEV Catalog are encouraged to submit them for consideration via CISA’s KEV Nomination Form, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.