CISA Updates KEV Catalog with New Exploited Vulnerabilities

What Changed Operationally

CISA has added two distinct vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, marking a shift in operational urgency for federal agencies and organizations monitoring active threat landscapes. The catalog now includes CVE-2026-110447, a code server OS command injection vulnerability in Collabora Online, and CVE-2026-114625, an SQL injection vulnerability affecting Arista VeloCloud Orchestrator. The operational significance of these additions lies in their alignment with Binding Operational Directive (BOD) 26-04, which mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. For these agencies, the directive reinforces that vulnerabilities identified by Common Vulnerabilities and Exposures (CVEs) on publicly exposed assets pose a significant risk because they grant total control of the asset post-exploitation. Consequently, the operational mandate is no longer limited to general patch management but is now strictly focused on rapid remediation of publicly exploited CVEs to prevent immediate compromise. While BOD 26-04 applies specifically to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management, recognizing that public-facing systems remain frequent attack vectors for malicious cyber actors.

The underlying mechanism driving these catalog additions is a rigorous, risk-based selection process designed to identify and catalog vulnerabilities that have been weaponized in the wild. CISA will continue to add vulnerabilities to the catalog only if they meet specific, stringent criteria: the vulnerability must possess a valid CVE ID, there must be evidence of active exploitation, and clear mitigation guidance must be available. This process ensures that the KEV Catalog serves as a prioritization tool rather than a comprehensive inventory of all security flaws. By focusing on exploited vulnerabilities, the catalog helps security teams distinguish between theoretical risks and immediate threats. The operational implication is that resources, such as patching cycles and incident response plans, must be dynamically adjusted to address these newly identified threats. Organizations are encouraged to submit potential KEV additions through nomination forms, fostering a collaborative approach to threat intelligence sharing and ensuring that the catalog remains a living document that reflects the current threat landscape.

How The Capability Fits Together

The architecture of the KEV Catalog functions as a centralized authority that aggregates and disseminates critical vulnerability intelligence. It operates as a high-level filter that cuts through the noise of thousands of daily vulnerability disclosures, highlighting only those that have crossed the threshold from potential risk to active exploitation. This centralized model allows for a unified standard of prioritization across the federal enterprise and, by extension, the broader cybersecurity community. The data flow involves the continuous intake of intelligence from various sources, validation of exploitation claims, and the publication of updates that trigger immediate action items for security operations centers. The catalog does not provide detailed technical exploitation code or specific mitigation steps for every entry; rather, it provides the critical signal that a vulnerability is being actively targeted. This signal is then used to trigger downstream processes, such as automated scanning for the presence of the vulnerable software on public assets and the initiation of remediation workflows.

The product does not do not provide real-time monitoring of exploitation attempts or forensic analysis of compromised systems. It does not replace the need for individual vulnerability scanners or penetration testing tools. Instead, the KEV Catalog serves as the authoritative source for prioritization, informing which vulnerabilities should be investigated and patched first. It does not offer remediation guidance itself, though it references the availability of such guidance. The catalog is a static, authoritative list that is updated periodically as new evidence emerges, requiring organizations to actively check for updates to maintain their operational awareness. By focusing solely on the "known exploited" status, the catalog allows security teams to deprioritize vulnerabilities that are theoretically dangerous but not currently being used by attackers, thereby optimizing their limited time and resources.

Operational Impact

Prioritizing Remediation and Governance

The addition of CVE-2026-110447 and CVE-2026-114625 to the Known Exploited Vulnerabilities (KEV) Catalog underscores the necessity of a rigorous governance framework for vulnerability management. For administrators and engineers, the primary directive is to shift from a reactive patching schedule to a risk-based prioritization model. This approach requires immediate triage of assets hosting these specific CVEs, particularly internet-facing systems where the risk of exploitation is highest. The Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize the rapid remediation of high-risk vulnerabilities listed in the KEV Catalog, specifically those that grant total control of the asset post-exploitation. While this directive applies to federal entities, the principle of prioritizing known exploited vulnerabilities is a critical control for any organization facing similar threats. Engineers must ensure that the remediation of CVE-2026-110447 and CVE-2026-114625 is treated as an immediate operational priority, distinct from routine maintenance windows.

Effective governance extends beyond the initial patching phase to include the verification of asset exposure and the integrity of the remediation process. Administrators should implement automated checks to identify all instances of the affected software—specifically Collabora Online and Arista VeloCloud Orchestrator—across the network. This process involves mapping the attack surface to ensure that no public-facing instances are left unpatched. Furthermore, governance requires a forensic triage to determine if systems have already been compromised. Given that threat actors frequently target public-facing devices with known vulnerabilities, a failure to patch CVE-2026-114625 could indicate an existing foothold within the network. Engineers must document the remediation steps taken for these critical CVEs to demonstrate compliance with risk-based management mandates and to provide a clear audit trail for stakeholders.

Rollout And Governance Decisions

Operational Readiness and Pilot Strategies

Preparing for the deployment of necessary mitigations involves a structured pilot and rollout strategy to minimize operational disruption. Before applying patches to the entire fleet, engineering teams should conduct a controlled pilot on non-production environments or a small subset of critical production systems. This pilot phase serves to validate that the remediation does not introduce compatibility issues or performance regressions. For CVE-2026-110447, which involves a code server OS command injection, testing must specifically verify that the patch does not disrupt the functionality of document collaboration workflows. Similarly, for the Arista VeloCloud Orchestrator SQL injection vulnerability (CVE-2026-114625), the pilot should assess the impact on network orchestration and management interfaces.

The rollout strategy should be segmented by risk profile, prioritizing systems that are most critical to business operations and most exposed to the internet. A phased approach allows administrators to monitor system stability and application behavior closely after each deployment wave. It is also essential to maintain offline backups of data and regularly test restoration processes, as seen in the context of ransomware operations. While the SafePay ransomware group targets known vulnerabilities to gain initial access, the subsequent deletion of backups is a common tactic to undermine recovery. Therefore, a pilot rollout must include verification of backup integrity to ensure that data remains recoverable in the event of a successful exploit. By treating the remediation of these vulnerabilities as a high-priority operational task with a structured testing and rollout plan, organizations can significantly reduce their attack surface and enhance their resilience against active exploitation.

Failure Modes And Limits

Failure Modes and Operational Risks

The integration of automated systems into security workflows introduces distinct failure modes that can undermine an organization's resilience. A primary risk involves the over-reliance on AI tools to identify vulnerabilities without manual verification. As security research notes indicate, while AI has lowered the barrier to entry and acts as a force multiplier, it should not replace the responsibility of the researcher. Testing AI-powered features requires a different mindset than traditional web bug hunting, particularly because attackers may influence probabilistic decision-making components. Organizations must ensure that automated findings are cross-referenced against the system's internal logic, data flows, and trust relationships. Relying solely on checklists or tools without understanding the underlying architecture can lead to false positives, where non-existent vulnerabilities are flagged, or false negatives, where critical flaws are missed due to the tool's inability to grasp complex trust boundaries.

Security And Privacy Considerations

Furthermore, the operational risk of a breach is amplified when known vulnerabilities remain unpatched on internet-facing assets. Threat actors frequently target public-facing devices with known vulnerabilities, as seen in the SafePay ransomware campaign that has impacted over 600 victims globally. Once an actor gains initial access through a compromised credential or an unpatched device, they often use legitimate IT tools to move laterally through the network. A critical failure mode in this scenario is the destruction of recovery mechanisms. The SafePay group has demonstrated a pattern of undermining recovery efforts by deleting or disabling backups immediately after gaining access. This specific tactic renders traditional backup restoration strategies ineffective, forcing organizations into a position where they must choose between paying a ransom or facing total data loss. Consequently, the failure to maintain offline backups and regularly test restoration processes represents a catastrophic operational gap that can turn a security incident into a prolonged outage.

Verification and Environmental Checklist

Open Questions

To mitigate the risks associated with these failure modes and ensure a robust security posture, organizations should implement the following checklist before deploying systems or responding to alerts:

• Patch Known Exploited Vulnerabilities: Prioritize the remediation of vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, such as CVE-2026-110447 and CVE-2026-114625, particularly on internet-facing systems.
• Implement Multifactor Authentication (MFA): Require MFA for all access points to reduce the likelihood of credential compromise, which is a primary vector for ransomware actors.
• Verify AI-Assisted Findings: Do not outsource the verification of security findings to AI. Manually review any conclusions drawn by automated tools to ensure they align with the system’s actual logic and data flows.
• Secure Backup Integrity: Maintain offline backups of critical data and regularly test restoration processes to ensure that backups are not encrypted or deleted by attackers.
• Network Segmentation: Segment networks to prevent threat actors from spreading laterally once they have compromised a single device.

Environment Checklist

Verification Statement

This article was not lab-tested. The information provided is synthesized from public advisories and research notes regarding current threat landscapes and security practices. Readers must verify all technical details, specific CVE impacts, and patch availability against official vendor documentation and their specific infrastructure before implementing changes in a production environment.