CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These new additions are CVE-2022-0492, a Linux Kernel Improper Authentication Vulnerability, and CVE-2025-48595, an Android Framework Integer Overflow Vulnerability. Both have demonstrated evidence of active exploitation by malicious actors. Such vulnerabilities frequently serve as attack vectors. They present significant risks to federal networks and the broader enterprise. Binding Operational Directive (BOD) 22-01 established the KEV Catalog to address these serious threats. This directive mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these identified vulnerabilities by a specified deadline. The goal is to protect FCEB networks from ongoing cyber threats. Although BOD 22-01 specifically targets FCEB agencies, CISA strongly advises all organizations to remediate KEV Catalog vulnerabilities. Prioritizing these remediations is crucial for effective vulnerability management and reducing overall cyberattack exposure. CISA will continue to update the catalog as new vulnerabilities meeting the criteria are identified.