CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The first is CVE-2025-68686, affecting Fortinet FortiOS and allowing unauthorized information exposure. The second is CVE-2026-16812, a command injection vulnerability in Arista VeloCloud Orchestrator On-Prem OS. These exploited vulnerabilities are common attack methods and present substantial risks. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for vulnerability management. This directive mandates prioritizing the rapid remediation of high-risk vulnerabilities from the KEV Catalog, particularly those on publicly exposed assets leading to total control. Lower-risk vulnerabilities can see deferred action. BOD 26-04 also sets expectations for checking for compromises before applying patches. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities. The agency will continue adding qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet listed via CISA's KEV Nomination Form, provided they have a CVE ID, exploitation evidence, and mitigation guidance.