On Oct. 28, 2026, CISA added CVE-2026-41709, the Broadcom VMWare ESX Insufficient Logging Vulnerability, and CVE-2026-46300, the Linux Kernel Missing Initialization of a Variable Vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
CISA said on Oct. 28, 2026 that actors frequently use the vulnerabilities as an attack vector and that they pose a major risk to the federal government. The Known Exploited Vulnerabilities Catalog lists vulnerabilities under active exploitation.
CISA said BOD 26-04, a binding operational directive titled Prioritizing Security Updates Based on Risk, creates rules for managing vulnerabilities at civilian federal agencies. It says agencies must address high-risk Known Exploited Vulnerabilities (KEV)-listed flaws first, before lower-risk issues, when the flaws sit on exposed assets and give an intruder full control after exploitation.
CISA said the directive also sets expectations for when agencies must decide whether a system was compromised before patching. It binds only FCEB agencies, the federal civilian executive branch, yet the agency urges every organization to manage risk and fix KEV-listed flaws first.
The agency says it will keep adding flaws to the catalog when they meet the required criteria. To join the catalog, a flaw needs a CVE ID, evidence of exploitation, and mitigation guidance submitted through CISA’s KEV Nomination Form.
Join the discussion