CISA has added a new vulnerability, CVE-2026-7273, affecting Zyxel GS1900 Series Switches, to its Known Exploited Vulnerabilities (KEV) Catalog. This stack-based buffer overflow vulnerability is actively being exploited by malicious actors. Such vulnerabilities represent a significant threat to federal agencies. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. This directive specifically targets vulnerabilities on public-facing assets that grant full control post-exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is specific to FCEB agencies, CISA urges all organizations to implement risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog that meet their criteria. Organizations can nominate exploited vulnerabilities not yet in the catalog using CISA's KEV Nomination Form. Submitted nominations require a CVE ID, proof of exploitation, and available mitigation steps.