CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. These include a Microsoft Windows Command Injection Vulnerability (CVE-2026-96951) and an Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935). Such vulnerabilities are common tools for cybercriminals and present major dangers. Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive (BOD) 26-04 for managing vulnerabilities. BOD 26-04 mandates prioritizing the immediate fixing of high-risk vulnerabilities, especially those in the KEV Catalog affecting publicly accessible systems. It also sets expectations for agencies to check for compromises before patching. Although BOD 26-04 is for FCEB agencies, CISA recommends all organizations use its risk-based approach. CISA will keep adding vulnerabilities to the KEV Catalog as they meet the criteria. Organizations can submit a suspected, unlisted exploited vulnerability through CISA’s KEV Nomination Form. Submitted vulnerabilities need a CVE ID, proof of exploitation, and clear mitigation steps.