CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog—CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass)—based on evidence of active exploitation, and reiterates BOD 26-04’s requirement that federal agencies prioritize rapid remediation of KEV-listed high-risk vulnerabilities while encouraging all organizations to adopt risk-based vulnerability management.