CISA has added a new vulnerability, CVE-2026-18577, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This authentication bypass vulnerability in N-able N-central is a common attack method. CISA's Binding Operational Directive (BOD) 26-04 mandates Federal Civilian Executive Branch (FCEB) agencies to prioritize fixing vulnerabilities listed in the KEV Catalog. This directive focuses on high-risk vulnerabilities on publicly exposed assets that allow complete control after exploitation. Agencies must also check for compromises before applying patches to these critical vulnerabilities. While BOD 26-04 applies to FCEB agencies, CISA strongly recommends all organizations adopt this risk-based approach. CISA will continue to identify and add exploited vulnerabilities to the KEV Catalog. Organizations can nominate vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation steps. This proactive approach aims to bolster cybersecurity defenses across critical infrastructure.