The **CISA** has issued a critical update to its **KEV** Catalog, adding two **TrueConf Server** vulnerabilities that are currently under active exploitation. This move underscores the persistent threat posed by unpatched software and reinforces the agency's call for immediate remediation. The newly listed vulnerabilities are: * **CVE-2026-72529**: A **TrueConf Server** Missing Authentication for Critical Function Vulnerability. * **CVE-2026-72530**: A **TrueConf Server** Code Injection Vulnerability. These types of flaws are frequently leveraged by malicious cyber actors, presenting significant risks to enterprise security. ### **Binding Operational Directive 26-04: A Mandate for Federal Agencies** **CISA**'s **Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk** mandates that Federal Civilian Executive Branch (**FCEB**) agencies prioritize the rapid remediation of high-risk vulnerabilities, particularly those listed in the **KEV** Catalog. The directive specifically targets publicly exposed assets where exploitation could grant total control. It also sets clear expectations for agencies to determine if systems were compromised *before* patches were applied. ### **Beyond Federal: A Call to Action for All Organizations** While **BOD 26-04** is binding only for **FCEB** agencies, **CISA** strongly encourages all organizations to adopt a similar risk-based vulnerability management strategy. Prioritizing the remediation of **KEV** Catalog vulnerabilities is crucial for bolstering overall cybersecurity posture. **CISA** continuously updates the **KEV** Catalog based on specific criteria, including the presence of a **CVE** ID, clear evidence of exploitation, and actionable mitigation guidance. Organizations aware of exploited vulnerabilities not yet listed in the catalog are encouraged to submit them via **CISA**'s **KEV Nomination Form**.