CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include vulnerabilities in Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, and two in SonicWall SMA1000 appliances. These types of vulnerabilities are common attack methods for cybercriminals and pose risks to federal systems. Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. BOD 26-04 specifically mandates rapid patching of vulnerabilities on publicly exposed assets that allow for total control after exploitation. The directive also sets expectations for agencies to check for compromises before applying patches. Although BOD 26-04 applies only to FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they meet the criteria. Organizations aware of exploited vulnerabilities not on the catalog can nominate them for inclusion.