IC Technology & Surveillance — 2026-04-13

CISA Adds Seven Known Exploited Vulnerabilities to Catalog, Mandating Federal Agency Remediation

CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, triggering mandatory remediation timelines for all Federal Civilian Executive Branch agencies under BOD 22-01. The additions come as CISA faces a proposed $707 million budget cut and staff reductions under the FY2027 Trump budget request, testing whether the agency can sustain its vulnerability tracking and enforcement mission while absorbing personnel losses.

Analysis
CISA's KEV catalog additions are authoritative; they require evidence of active exploitation, not just theoretical risk. The juxtaposition with CISA's proposed $707M budget cut and staff reductions raises a capacity question: BOD 22-01 mandates federal agency remediation, but enforcement requires CISA staff who may not be retained. If the agency loses the personnel to track compliance, the catalog becomes an unfunded mandate. Seven new KEVs in a single batch is within normal operating tempo, but the agency's ability to maintain this pace while absorbing cuts is untested.

1 sources

CISA Adds Seven Known Exploited Vulnerabilities to Catalog