CISA has added two new vulnerabilities, CVE-2026-65660 affecting Microsoft SharePoint and CVE-2026-67279 concerning Mikrotik RouterOS, to its Known Exploited Vulnerabilities (KEV) Catalog. These additions are due to evidence of active exploitation by malicious cyber actors, posing significant risks. Federal Civilian Executive Branch (FCEB) agencies are required by Binding Operational Directive (BOD) 26-04 to prioritize security updates based on risk. This directive specifically emphasizes the KEV Catalog for identifying high-risk vulnerabilities on publicly exposed assets. FCEB agencies must swiftly remediate KEV-listed vulnerabilities that grant total control post-exploitation. BOD 26-04 also outlines requirements for agencies to check for compromises before patching. While this directive is for FCEB agencies, CISA urges all organizations to adopt similar risk-based vulnerability management. CISA will continue to update the KEV Catalog with newly identified exploited vulnerabilities. Organizations can nominate exploited vulnerabilities not yet on the KEV list by providing a CVE ID, exploitation evidence, and mitigation guidance.