CISA has added a new vulnerability, CVE-2026-64849, to its Known Exploited Vulnerabilities (KEV) Catalog. This is due to evidence of its active exploitation, posing significant risks to federal systems. Server-Side Request Forgery vulnerabilities are a common attack method for malicious actors. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive emphasizes addressing high-risk vulnerabilities on publicly exposed assets that grant complete control upon exploitation. Agencies are also expected to check for prior compromise before applying patches. Although BOD 26-04 is for federal agencies, CISA urges all organizations to adopt risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations can nominate exploited vulnerabilities not yet on the list via CISA’s KEV Nomination Form. Submitted nominations require a CVE ID, proof of exploitation, and clear mitigation steps.