CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two TrueConf Server vulnerabilities (CVE-2026-72529: missing authentication for a critical function; CVE-2026-72530: code injection) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The advisory emphasizes that such vulnerabilities are high-risk, references BOD 26-04 requirements for federal agencies to prioritize remediation of KEV-listed issues on public-facing assets, and encourages organizations to adopt risk-based vulnerability management and to submit evidence of exploited vulnerabilities for KEV consideration.