CISA has identified a new vulnerability, CVE-2026-34197, in its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects Apache ActiveMQ and is due to improper input validation. Evidence indicates this vulnerability is actively being exploited by malicious actors. Such vulnerabilities are common attack methods and present substantial risks to federal systems. Binding Operational Directive 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies address these KEV Catalog vulnerabilities. The KEV Catalog is a dynamic list of vulnerabilities with significant risk to the federal enterprise. FCEB agencies must remediate listed vulnerabilities by their deadlines to enhance network security. While this directive specifically targets FCEB agencies, CISA strongly recommends all organizations adopt this practice. Prioritizing the remediation of KEV Catalog vulnerabilities is crucial for mitigating cyberattack exposure. CISA will continue to update the KEV Catalog with new vulnerabilities that meet the established criteria.