CISA has added a new vulnerability, CVE-2026-76504 concerning Cisco Catalyst SD-WAN Manager Hex Encoding, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability has been observed in active exploitation, making it a significant threat. Such vulnerabilities are commonly used by malicious actors against federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of high-risk vulnerabilities found in the KEV Catalog. This directive specifically targets vulnerabilities on publicly exposed assets that grant complete control post-exploitation. Agencies are also required to assess for prior compromise before applying patches. While BOD 26-04 is for federal agencies, CISA urges all organizations to adopt similar risk-based approaches to vulnerability management. CISA will continue to update the KEV Catalog with vulnerabilities meeting the established criteria. Organizations that are aware of exploited vulnerabilities not yet in the KEV Catalog can submit them for consideration. Submissions require a CVE ID, evidence of exploitation, and clear mitigation steps.