CISA and BOD 26-04 require Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets. All organizations should apply available patches, adopt risk-based vulnerability management, and check for prior compromise before patching. Vulnerabilities can be nominated for addition to the KEV Catalog via CISA's KEV Nomination Form if they meet criteria of a CVE ID, evidence of exploitation, and clear mitigation guidance.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-86218, a pre-authentication remote code execution vulnerability in N-able N-central, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw carries a CVSS score of 10.0 and requires Federal Civilian Executive Branch (FCEB) agencies to apply mitigating fixes by September 11, 2026.
The Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The additions include CVE-2026-75650 affecting Adobe Commerce and Magento, CVE-2026-81963 and CVE-2026-85880 affecting Microsoft Windows, and CVE-2026-86218 affecting N-able N-central. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets.
