CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These identified vulnerabilities are CVE-2026-42016 and CVE-2026-42018 affecting JFrog Artifactory, and CVE-2026-84869 impacting ConnectWise ScreenConnect. Exploited vulnerabilities are a common method for cyberattacks and present substantial dangers. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for vulnerability management. This directive emphasizes the significance of the KEV Catalog for prioritizing the swift patching of high-risk vulnerabilities on public-facing systems. BOD 26-04 also sets requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations implement risk-based vulnerability management. Prioritizing the remediation of KEV Catalog vulnerabilities is highly encouraged. CISA will continue to update the KEV Catalog with qualifying vulnerabilities. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form.