CISA has added CVE-2026-20316, a Cisco Secure Firewall Management Center vulnerability involving a hard-coded password, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is a common attack method that presents serious risks to federal systems. Federal agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the rapid patching of vulnerabilities listed in the KEV Catalog, especially those on public-facing assets granting full control after exploitation. BOD 26-04 also sets requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is specific to Federal Civilian Executive Branch agencies, CISA recommends that all organizations implement risk-based vulnerability management and address KEV Catalog items. CISA will continue to update the KEV Catalog as new exploited vulnerabilities are identified. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.