CISA has added two new vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities affect Citrix NetScaler and involve improper input validation and restriction of operations within memory buffers. They are frequently used by cyber actors and present significant risks to federal systems. Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to manage vulnerabilities based on risk. This directive emphasizes the KEV Catalog for prioritizing the remediation of high-risk vulnerabilities on publicly exposed assets. BOD 26-04 also sets expectations for checking system compromise prior to patching. While the directive targets FCEB agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add vulnerabilities to the KEV Catalog as they meet the established criteria. Organizations can nominate exploited vulnerabilities not yet on the list via CISA’s KEV Nomination Form. Submitted vulnerabilities must have a CVE ID, evidence of exploitation, and clear mitigation information.