CISA has added a new vulnerability, CVE-2025-54948, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects Trend Micro Apex One and involves an OS command injection flaw. Such vulnerabilities are commonly used by cyber actors and present significant risks. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to list vulnerabilities with significant risks. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by a set deadline. This directive aims to protect FCEB networks from active threats. While BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to address KEV Catalog vulnerabilities. Prioritizing remediation is crucial for reducing exposure to cyberattacks. CISA will continue to update the KEV Catalog with new vulnerabilities that meet its criteria. This ongoing process ensures organizations are informed about critical security risks.