CISA has added two new vulnerabilities, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities in Zammad GmbH software are considered significant risks for cyber attacks. Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize the remediation of high-risk vulnerabilities. Specifically, this directive mandates rapid updates for vulnerabilities listed in the KEV Catalog that offer full control of an asset after exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before patches are applied. Although BOD 26-04 is exclusive to FCEB agencies, CISA recommends that all organizations implement risk-based vulnerability management. CISA will continue to update the KEV Catalog with vulnerabilities meeting their criteria. Organizations can nominate exploited vulnerabilities not yet on the list using CISA's KEV Nomination Form. Nominated vulnerabilities must have a CVE ID, proof of exploitation, and available mitigation steps.