CISA has added a new vulnerability, CVE-2026-10520 concerning Ivanti Sentry OS Command Injection, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability has been actively exploited and presents a significant threat. Command injection vulnerabilities are a common attack method used by malicious actors. Federal Civilian Executive Branch (FCEB) agencies are now subject to Binding Operational Directive (BOD) 26-04. This directive mandates prioritizing security updates based on risk, superseding BOD 22-01. BOD 26-04 emphasizes the KEV catalog and requires FCEB agencies to quickly fix high-risk vulnerabilities, particularly those on public assets that grant full control post-exploitation. Lower-risk vulnerabilities can have their remediation deferred. The directive also sets expectations for agencies regarding system compromise checks before patching. While BOD 26-04 is for FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.