CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA's addition of CVE-2026-114713 and CVE-2026-123039 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively leveraging these flaws against real targets, including federal systems. When known vulnerabilities remain unpatched on publicly exposed assets, organizations hand attackers a documented, low-effort path into their networks. The KEV Catalog exists precisely because patch backlogs and poor asset visibility routinely allow exploitable conditions to persist long after fixes are available. Federal agencies are legally bound under BOD 26-04 to remediate KEV entries promptly, yet the continued exploitation of cataloged vulnerabilities signals that remediation timelines are still too slow across the broader ecosystem. Organizations of all types should treat KEV additions as urgent operational signals, not routine advisory notices.