CISA has recently added two new PaperCut NG/MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These vulnerabilities, often exploited by malicious actors, pose significant risks. Binding Operational Directive (BOD) 26-04 mandates vulnerability management for Federal Civilian Executive Branch (FCEB) agencies. This directive emphasizes the criticality of the KEV Catalog, requiring federal agencies to swiftly remediate high-risk vulnerabilities, especially those in the KEV Catalog on publicly exposed assets that grant total control. It also sets expectations for agencies to check for system compromise before applying patches. Although BOD 26-04 targets FCEB agencies, CISA strongly advises all organizations to implement risk-based vulnerability management and prioritize KEV Catalog remediations. CISA consistently updates the catalog with vulnerabilities meeting specific criteria. Organizations aware of exploited vulnerabilities not yet listed can nominate them through CISA's KEV Nomination Form. Nominations require a CVE ID, evidence of exploitation, and explicit mitigation guidance.