CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. These newly cataloged items are: CVE-2026-102895 regarding a GPUStack Improper Authentication Vulnerability, CVE-2026-116779 concerning a SignalWire FreeSwitch Code Injection Vulnerability, CVE-2026-123158 related to an OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability, and CVE-2026-123218 concerning an IBM Aspera Faspex Incorrect Authorization Vulnerability.
Binding Operational Directive (BOD) 26-04 sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. This directive mandates that federal agencies prioritize rapid remediation of high-risk vulnerabilities listed in the KEV Catalog, specifically those on publicly exposed assets that grant total control post-exploitation. The directive requires agencies to check if threat actors compromised a system before applying patches for these prioritized vulnerabilities.
CISA encourages all organizations to adopt risk-based vulnerability management and address KEV Catalog vulnerabilities. Organizations can submit unlisted exploited vulnerabilities to CISA via the KEV Nomination Form, requiring a CVE ID, exploitation evidence, and mitigation guidance for potential addition.

* Four new vulnerabilities were added to the Known Exploited Vulnerabilities (KEV) Catalog.
* The vulnerabilities are: CVE-2026-102895 (GPUStack Improper Authentication Vulnerability), CVE-2026-116779 (SignalWire FreeSwitch Code Injection Vulnerability), CVE-2026-123158 (OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability), and CVE-2026-123218 (IBM Aspera Faspex Incorrect Authorization Vulnerability).
* Binding Operational Directive (BOD) 26-04 establishes vulnerability management requirements for FCEB agencies.
* BOD 26-04 requires federal agencies to prioritize remediation of high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets that grant total control post-exploitation.
* BOD 26-04 mandates checking whether threat actors compromised a system before applying patches for these prioritized vulnerabilities.
* CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
* Exploited vulnerabilities not in the KEV Catalog can be nominated through CISA’s KEV Nomination Form, requiring CVE ID, exploitation evidence, and mitigation guidance.

The mechanism presented establishes a tiered system of risk-based response enforced through federal directive, while simultaneously creating a voluntary framework for broader adoption. The tension exists between mandated, high-stakes requirements for FCEB agencies under BOD 26-04, which targets systems with total post-exploitation control, and the encouragement extended to all organizations to manage KEV risks proactively. This structure signals an acknowledgment that vulnerability exposure is not uniform across the threat landscape, demanding a differentiated response based on asset criticality.
The process of seeking nominations for unlisted vulnerabilities introduces a mechanism for collective threat intelligence, shifting the burden from isolated discovery to community-driven cataloging. However, the reliance on evidence of exploitation and clear mitigation guidance in the nomination process requires scrutiny regarding the standardization and verification of that evidence across different entities. The focus on control grants post-exploitation highlights an awareness that vulnerability management is less about patching a single flaw and more about controlling the environment's ultimate state.
The pattern suggests a top-down enforcement strategy layered with bottom-up intelligence gathering: CISA sets the standard via BOD 26-04, defining *what* must be prioritized (publicly exposed, total control), and simultaneously solicits input to enrich that knowledge base. The implication is that true resilience relies on recognizing that the risk profile of a vulnerability is defined not by its mere existence, but by the contextual power it grants an adversary over the system after initial compromise.
Bridge Questions: How will the practical application of BOD 26-04 be monitored across disparate organizational structures? What are the systemic barriers to ensuring that submissions to the KEV Nomination Form meet the necessary standard for catalog addition? Does focusing remediation efforts solely on publicly exposed, high-control assets unintentionally create blind spots in less visible but equally critical internal systems?