[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXdG8WaCa8dCg2A7R5hVQXZUjJz6DPvTwYVFXeoZWTT4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"aed8b91e-aaf7-4b7e-a600-16b1e47c3af5","actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation","1ba99e0c-207a-4acf-8ed5-dc6a34a23c3f","Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation","CISA's addition of CVE-2026-114713 and CVE-2026-123039 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively leveraging these flaws against real targets, including federal systems. When known vulnerabilities remain unpatched on publicly exposed assets, organizations hand attackers a documented, low-effort path into their networks. The KEV Catalog exists precisely because patch backlogs and poor asset visibility routinely allow exploitable conditions to persist long after fixes are available. Federal agencies are legally bound under BOD 26-04 to remediate KEV entries promptly, yet the continued exploitation of cataloged vulnerabilities signals that remediation timelines are still too slow across the broader ecosystem. Organizations of all types should treat KEV additions as urgent operational signals, not routine advisory notices.","**Immediate actions:**\n- Apply vendor-supplied patches or mitigations for CVE-2026-114713 and CVE-2026-123039 on all affected systems within BOD 26-04 deadlines (or your internal SLA for critical vulnerabilities).\n- Run an authenticated vulnerability scan against all internet-facing assets today to confirm exposure status for both CVEs.\n- Temporarily isolate or restrict external access to any asset that cannot be patched immediately until remediation is complete.\n\n**Long-term improvements:**\n- Subscribe directly to the CISA KEV Catalog feed and integrate it into your vulnerability management platform to trigger automatic prioritization alerts.\n- Maintain a continuously updated, authoritative inventory of all internet-exposed assets so KEV additions can be cross-referenced within hours, not days.\n- Define and enforce a tiered emergency patching SLA (e.g., critical\u002FKEV-listed: 48–72 hours) with executive sign-off and documented escalation paths.\n\n**Detection measures:**\n- Deploy network and host-based monitoring rules tuned to exploitation indicators associated with newly cataloged CVEs.\n- Review logs for anomalous activity on affected systems dating back at least 30 days to identify potential compromise that preceded the KEV listing.\n- Establish a threat-intelligence workflow that correlates KEV additions with internal asset data and triggers incident-response triage automatically.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","CIS Control 1: Inventory and Control of Enterprise Assets (v8)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":21,"NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks":22},"NIS2 Article 21(2)(e) requires entities to handle vulnerability disclosure and security in system maintenance, obligating operators to remediate known exploited vulnerabilities as part of their ongoing security obligations.","SI-2 mandates that organizations identify, report, and correct system flaws within organizationally defined time periods, which is exactly what BOD 26-04 enforces for KEV-listed vulnerabilities on federal assets.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, directly addressing the failure to patch actively exploited CVEs before or immediately after they appear in the KEV Catalog.","An accurate asset inventory is a prerequisite for knowing which systems are exposed to KEV-listed CVEs; without it, organizations cannot confirm whether affected software exists on publicly reachable hosts.","This category directly covers the expectation that once a vulnerability is confirmed as exploited and cataloged, the organization must act to mitigate it or formally accept and document the risk.","published","2026-11-13T21:21:21.411952+00:00","2026-11-13T21:21:21.381+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F11\u002F13\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-7b5dac","CISA Adds Two Known Exploited Vulnerabilities to Catalog",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,51],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":49,"problem":50},"Automated patch management","Known holes get closed in days, not months.",{"slug":52,"name":53,"problem":54},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]