CISA has added two new vulnerabilities, CVE-2025-61624 and CVE-2026-102764, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities, affecting Fortinet products and BeyondTrust Remote Support respectively, are actively being exploited. Such vulnerabilities represent a common attack method for cybercriminals and create substantial risks for federal systems. Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch agencies prioritize fixing high-risk vulnerabilities. These include those listed in the KEV Catalog that grant full control of an asset after exploitation on publicly accessible systems. BOD 26-04 also outlines requirements for agencies to check for compromises before applying patches. Although BOD 26-04 is specific to federal agencies, CISA recommends that all organizations implement risk-based vulnerability management. This means prioritizing the remediation of any vulnerability found in the KEV Catalog. CISA will consistently update the KEV Catalog with new vulnerabilities that meet their established criteria. Organizations can nominate exploited vulnerabilities not yet on the list by submitting them through CISA’s KEV Nomination Form.