CISA adds four vulnerabilities to KEV Catalog; alert restates BOD 26-04 remediation requirements

Linha do tempo

1. cisa.gov ↗ · pub. 14/10/2026 09:00 · coletado 19/10 18:37 primeiro registro

   CISA adds four vulnerabilities to KEV Catalog; alert restates BOD 26-04 remediation requirements

   ler a análise desta fonte ocultar

   CISA announced the addition of four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-14. The excerpt available does not name the CVEs, affected vendors or products, exploitation details, threat actor attribution or IOCs. The text focuses on Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, which sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. Because KEV listing indicates exploitation in the wild, defenders should review the full CISA alert for the specific CVEs.

   Technical Details

   • The four CVEs are not listed in the provided text.
   • BOD 26-04 targets KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
   • No affected versions, exploitation methods or IOCs are given.

   Remediation

   • Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, and may defer action on lower-risk vulnerabilities.
   • BOD 26-04 sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
   • Consult the full CISA alert and vendor advisories for the specific CVEs and patch guidance.