CISA has added CVE-2026-88779, a Citrix NetScaler memory buffer vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability has been actively exploited and represents a significant risk to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize patching vulnerabilities listed in the KEV Catalog. These vulnerabilities are considered high-risk, especially when they can lead to complete system control post-exploitation on publicly accessible assets. BOD 26-04 also outlines requirements for agencies to check for system compromise before applying patches. Although BOD 26-04 applies specifically to FCEB agencies, CISA strongly recommends all organizations adopt similar risk-based vulnerability management practices. This includes prioritizing the remediation of any vulnerabilities found in the KEV Catalog. CISA will continue to update the KEV Catalog with vulnerabilities that meet its criteria. Organizations can nominate vulnerabilities for inclusion in the KEV Catalog if they have a CVE ID, evidence of exploitation, and clear mitigation steps.