CISA has added CVE-2026-21962, an Oracle HTTP Server and Oracle Weblogic Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited by malicious actors and presents serious risks. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize fixing high-risk vulnerabilities found in CISA's KEV Catalog. This directive specifically targets vulnerabilities on publicly exposed assets that allow complete system control after exploitation. BOD 26-04 also outlines requirements for agencies to check for system compromise before applying patches. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog that meet the established criteria. Organizations can nominate exploited vulnerabilities not yet in the KEV Catalog via CISA's nomination form. Submitted vulnerabilities must have a CVE ID, proof of exploitation, and clear mitigation steps.