CISA Adds Four Exploited Vulnerabilities to KEV Catalog, Mandating Federal Agency Action
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and requiring federal agencies to prioritize patching.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of four new vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV). This inclusion signifies that these flaws have been observed under active exploitation by malicious actors, posing a significant threat to organizations.
The newly cataloged vulnerabilities include CVE-2026-102895 affecting GPUStack with an improper authentication flaw, CVE-2026-116779 in SignalWire FreeSwitch enabling code injection, CVE-2026-123158 related to an unexpected status code or return value in OpenBSD's OpenSSH implementation, and CVE-2026-123218 which is an incorrect authorization vulnerability in IBM Aspera Faspex.
These types of vulnerabilities are frequently leveraged by threat actors as attack vectors. Their inclusion in the KEV catalog underscores the urgency for remediation, particularly for organizations handling sensitive data or critical infrastructure. The active exploitation means that systems not yet patched are at immediate risk of compromise.
CISA's Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog. This directive specifically targets publicly exposed assets that, if exploited, grant total control of the asset post-exploitation. Agencies are required to manage these risks by rapidly patching these high-priority vulnerabilities.
While BOD 26-04 applies specifically to federal agencies, CISA strongly encourages all organizations, including those in the private sector, to adopt a risk-based vulnerability management approach. Prioritizing the remediation of vulnerabilities present in the KEV Catalog is a crucial step in bolstering overall cybersecurity posture.
The directive also establishes basic expectations for agencies regarding the detection of potential compromises that may have occurred before a patch was applied. This proactive stance aims to mitigate the impact of successful attacks and ensure timely incident response.
CISA continues to monitor the threat landscape and will regularly update the KEV Catalog with new vulnerabilities that meet the established criteria for active exploitation. Organizations can also submit potential KEV additions through CISA's KEV Nomination Form if they are aware of exploited vulnerabilities not yet listed, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.
The inclusion of these four vulnerabilities highlights the dynamic nature of cyber threats and the ongoing need for robust vulnerability management programs. By staying informed and acting swiftly on CISA's advisories, organizations can significantly reduce their attack surface and protect against known, actively exploited threats.