CISA has added a new vulnerability, CVE-2026-48558, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This SimpleHelp Authentication Bypass Vulnerability is a common attack method. Federal agencies are required by Binding Operational Directive (BOD) 26-04 to manage vulnerabilities based on risk. BOD 26-04 mandates rapid remediation of high-risk vulnerabilities found in the KEV Catalog on publicly exposed assets. This directive also sets expectations for agencies to check for compromises before patching. While BOD 26-04 is for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet in the catalog using CISA's KEV Nomination Form. Nominations require a CVE ID, proof of exploitation, and clear mitigation steps.