CISA Adds Two Known Exploited Vulnerabilities to Catalog
Summary
CISA has added two new vulnerabilities, CVE-2026-97229 and CVE-2026-76418, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These additions reinforce the importance of CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog.
IFF Assessment
The addition of actively exploited vulnerabilities to CISA's KEV catalog indicates new threats that defenders need to prioritize and mitigate.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 01, 2026. Known ransomware use: Unknown.
Defender Context
Defenders must stay vigilant regarding CISA's KEV catalog, as it highlights vulnerabilities actively being exploited by threat actors. Prioritizing patching for these identified CVEs, especially on publicly exposed assets, is crucial for mitigating immediate risks and aligning with regulatory expectations.