CISA has added a new WordPress Core Remote File Inclusion Vulnerability, CVE-2026-87902, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is a common and significant threat to federal systems due to active exploitation. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing vulnerabilities listed in the KEV Catalog. This directive specifically targets publicly exposed assets granting total control post-exploitation. BOD 26-04 also requires agencies to check for compromises before applying patches. While BOD 26-04 applies to FCEB agencies, CISA recommends all organizations use risk-based vulnerability management. Organizations should prioritize remediating KEV Catalog vulnerabilities. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. If an exploited vulnerability is known but not in the KEV Catalog, it can be nominated. Submissions require a CVE ID, proof of exploitation, and mitigation steps.