CISA has added a new vulnerability, CVE-2026-104286, affecting Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog. This path traversal vulnerability is a common attack method used by cybercriminals and presents major risks to federal systems. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the KEV Catalog and requires agencies to quickly fix high-risk vulnerabilities listed there on public-facing assets. These critical vulnerabilities grant full control of an asset after exploitation. BOD 26-04 also outlines when agencies must check for prior compromise before applying patches. Although BOD 26-04 is for FCEB agencies, CISA urges all organizations to prioritize KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities that meet its criteria to the KEV Catalog. Organizations aware of exploited vulnerabilities not yet on the KEV Catalog can submit them for consideration. Submissions require a CVE ID, proof of exploitation, and clear mitigation steps.