CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. These vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Intelligence analysis by Llama
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. These vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The vulnerabilities include CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486.
Imagine you're playing a game where someone can hack into the game and take control of everything. That's what these vulnerabilities are like, but for computers. They're like backdoors that hackers can use to get into a system and do bad things. CISA is like the game moderator, and they're trying to fix these vulnerabilities so that hackers can't get in.
Analysis
A New Addition to the KEV Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. These vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
The three new vulnerabilities added to the KEV Catalog are CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486. CVE-2026-9198 is an IBM Langflow Code Injection Vulnerability, CVE-2026-18556 is an N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability, and CVE-2026-34486 is an Apache Tomcat Missing Encryption of Sensitive Data Vulnerability.
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.
BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
Key points
- CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog.
- The three new vulnerabilities are CVE-2026-9198, CVE-2026-18556, and CVE-2026-34486.
- These vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
- CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
CISA's efforts to add vulnerabilities to the KEV Catalog will help federal agencies prioritize rapid remediation of high-risk vulnerabilities, reducing the risk of cyber attacks. Additionally, the KEV Catalog will continue to be updated with new vulnerabilities that meet the specified criteria, ensuring that federal agencies have the most up-to-date information to protect their systems.
If federal agencies do not prioritize rapid remediation of high-risk vulnerabilities, malicious cyber actors may be able to exploit these vulnerabilities and gain access to sensitive data. This could lead to significant risks to the federal enterprise, including data breaches and system compromise.
