CISA has added CVE-2026-63077, a JetBrains TeamCity deserialization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This type of vulnerability is a common attack vector posing significant risks. Binding Operational Directive 26-04 mandates Federal Civilian Executive Branch (FCEB) agencies to prioritize the remediation of vulnerabilities listed in the KEV Catalog, especially those on public-facing assets. The directive emphasizes a risk-based approach, requiring rapid action for high-risk vulnerabilities and deferring lower-risk ones. BOD 26-04 also sets expectations for agencies to check for compromises before applying patches. While the directive is specific to FCEB agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. CISA will continue to add vulnerabilities to the KEV Catalog as they are identified and meet the criteria. Organizations can nominate exploited vulnerabilities not yet in the KEV Catalog via CISA's KEV Nomination Form. For a nomination, a CVE ID, evidence of exploitation, and clear mitigation guidance are required.