CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The agency based the additions on evidence of active exploitation.
The four entries are: - CVE-2026-102895, a GPUStack improper authentication vulnerability - CVE-2026-116779, a SignalWire FreeSwitch code injection vulnerability - CVE-2026-123158, an OpenBSD OpenSSH unexpected status code or return value vulnerability - CVE-2026-123218, an IBM Aspera Faspex incorrect authorization vulnerability
CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies. It requires those agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation. The directive also sets expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
BOD 26-04 applies only to F