CISA has added a new vulnerability, CVE-2026-86950, affecting Apple products, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. This out-of-bounds write vulnerability is a common and serious threat to federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. Agencies must focus on high-risk KEV vulnerabilities on publicly exposed assets that offer complete control post-exploitation. BOD 26-04 also outlines requirements for checking for system compromise before patching. Although BOD 26-04 is specific to FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. CISA will continue to update the KEV Catalog with vulnerabilities meeting the exploitation criteria. Organizations can nominate vulnerabilities not yet on the catalog via the KEV Nomination Form. Submitted vulnerabilities must have a CVE ID, proof of exploitation, and actionable mitigation steps.