CISA adds three exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog

CISA said it added three vulnerabilities to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

The agency said exploited flaws are a frequent attack vector for malicious cyber actors and can pose significant risks to the federal enterprise. It also pointed federal civilian agencies to Binding Operational Directive 26-04, which sets vulnerability management requirements for those agencies and directs them to prioritize rapid remediation of high-risk issues listed in the KEV Catalog.

The three vulnerabilities named in the alert are CVE-2026-9198, described by CISA as an IBM Langflow code injection vulnerability; CVE-2026-18556, described as an N-able N-central authentication bypass using an alternate path or channel vulnerability; and CVE-2026-34486, described as an Apache Tomcat missing encryption of sensitive data vulnerability.

CISA said BOD 26-04 applies to Federal Civilian Executive Branch agencies only. It said the directive expects agencies to focus on high-risk vulnerabilities on publicly exposed assets that could grant total control after exploitation, and to check whether threat actors compromised a system before patching in cases where that step is warranted.

The agency said it encourages all organizations to use risk-based vulnerability management and to prioritize KEV Catalog items. It also said it will keep adding vulnerabilities that meet its criteria.

CISA said potential additions to the catalog must have a CVE ID, evidence of exploitation and clear mitigation guidance. The agency also said organizations can submit nominations through its KEV Nomination Form for exploited vulnerabilities that are not yet listed.

Sources

• CISA alert: CISA adds three known exploited vulnerabilities to catalog

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.