CISA has added a new vulnerability, CVE-2026-76461, concerning Cisco Secure Email Gateway SQL injection, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability is actively being exploited by malicious actors and presents substantial risks to federal systems. Binding Operational Directive 26-04 mandates that Federal Civilian Executive Branch agencies prioritize patching vulnerabilities listed in the KEV Catalog on their public-facing assets. This directive focuses on vulnerabilities that, once exploited, grant complete control of the affected system. BOD 26-04 also outlines requirements for agencies to check for compromises prior to patching. Although BOD 26-04 specifically targets FCEB agencies, CISA strongly advises all organizations to implement risk-based vulnerability management. This includes prioritizing the remediation of vulnerabilities identified in the KEV Catalog. CISA will continue to identify and add vulnerabilities to the KEV Catalog as they are discovered and exploited. Organizations aware of exploited vulnerabilities not yet in the catalog can submit them for consideration using CISA's KEV Nomination Form. To be nominated, a vulnerability must have a CVE ID, proof of exploitation, and documented mitigation steps.