CISA has added a new vulnerability, CVE-2026-42897, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This vulnerability targets Microsoft Exchange Server and involves cross-site scripting, a common attack method. The KEV Catalog identifies vulnerabilities posing significant risks, especially to the federal enterprise. Binding Operational Directive (BOD) 22-01 mandates FCEB agencies remediate KEV vulnerabilities by set deadlines. This directive aims to protect federal networks from existing threats. The provided fact sheet offers further details regarding BOD 22-01 implementation. While BOD 22-01 specifically affects FCEB agencies, CISA advises all organizations to prioritize KEV remediation. Timely addressing these vulnerabilities is crucial for reducing cyberattack exposure. Organizations should integrate KEV remediation into their overall vulnerability management strategies. CISA will continuously update the catalog with qualifying vulnerabilities.