CISA has added a new vulnerability, CVE-2026-28318, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability in SolarWinds Serv-U involves uncontrolled resource consumption. Actively exploited vulnerabilities like this are common attack vectors for cybercriminals. Such vulnerabilities present substantial risks to federal agencies. The KEV Catalog was established by Binding Operational Directive (BOD) 22-01 to combat these significant risks. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies fix these vulnerabilities by a deadline. This is to safeguard FCEB networks from active cyber threats. While BOD 22-01 specifically targets FCEB agencies, CISA recommends all organizations prioritize fixing KEV Catalog vulnerabilities. This action helps reduce their susceptibility to cyberattacks. CISA will keep updating the KEV Catalog with new vulnerabilities that fit the criteria.