CISA has added CVE-2026-48907, an improper access control vulnerability in the Widget Factory Joomla Content Editor, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability is actively being exploited and presents a significant risk to federal systems. Binding Operational Directive (BOD) 26-04 updates requirements for Federal Civilian Executive Branch (FCEB) agencies regarding vulnerability management. The directive emphasizes prioritizing the remediation of high-risk vulnerabilities, particularly those listed in the KEV catalog that grant full control after exploitation on public-facing assets. Lower-risk vulnerabilities can be addressed with less urgency. BOD 26-04 also outlines when agencies must check for system compromise before patching. Although BOD 26-04 is specific to FCEB agencies, CISA recommends all organizations adopt a risk-based approach to vulnerability management. They encourage prioritizing KEV catalog vulnerabilities for remediation. CISA will continue to add vulnerabilities meeting their criteria to the KEV catalog. Organizations can nominate exploited vulnerabilities for inclusion if they have a CVE ID, proof of exploitation, and mitigation guidance.