CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding a new vulnerability. This newly listed vulnerability is CVE-2026-33825, impacting Microsoft Defender. It involves insufficient access control, a common attack vector used by malicious actors. This vulnerability poses considerable risks, particularly for federal agencies. The KEV Catalog is a dynamic list of known vulnerabilities with significant risks, as defined by Binding Operational Directive (BOD) 22-01. BOD 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate KEV vulnerabilities by set deadlines. Remediation protects FCEB networks from active cyber threats, as outlined in the BOD 22-01 Fact Sheet. While the directive primarily targets FCEB agencies, CISA recommends all organizations address KEV vulnerabilities promptly. Prioritizing remediation helps organizations lessen their vulnerability to cyberattacks. CISA plans to continuously expand the catalog with vulnerabilities meeting its criteria.