CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. The vulnerabilities are CVE-2026-76460 affecting Cisco Identity Services Engine and CVE-2026-87886 impacting Acronis Backup. Exploited vulnerabilities are common attack methods, presenting significant risks to federal systems. Binding Operational Directive 26-04 requires federal agencies to prioritize fixing high-risk vulnerabilities listed in the KEV Catalog. This directive specifically targets vulnerabilities on public-facing assets that allow full control upon exploitation. Federal agencies must also implement checks for prior compromise before applying patches. While BOD 26-04 is for federal agencies, CISA recommends all organizations adopt similar risk-based vulnerability management. CISA will continue to add qualifying vulnerabilities to the KEV Catalog. Organizations can nominate exploited vulnerabilities not yet in the catalog via CISA's KEV Nomination Form. Submitted vulnerabilities must have a CVE ID, proof of exploitation, and clear mitigation steps.