CISA has added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The newly listed CVE is CVE-2026-85046, described as a Google Chromium V8 Type Confusion Vulnerability. The KEV entry notes that this class of flaw is a frequent attack vector and poses significant risks to the federal enterprise.
The alert emphasises that the binding Operational Directive 26-04 requires agencies to prioritise security updates for high‑risk vulnerabilities identified in the KEV Catalog, particularly on publicly exposed assets that could grant total control post‑exploitation. While BOD 26‑04 applies to Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organisations to adopt risk‑based vulnerability management and to remediate KEV‑listed issues accordingly.
The agency also invites organisations to nominate additional exploited vulnerabilities for KEV consideration, provided they have a CVE ID, evidence of exploitation, and clear mitigation guidance.
In practical terms, entities with exposed systems should prioritise remediation of CVE‑listed weaknesses that carry a similar level of risk, aligning with the KEV catalog’s criteria. CISA indicates it will continue to add vulnerabilities meeting the specified thresholds, and it reiterates the process for nominating potential KEV additions. The notice concludes with the standard guidance and contact options for reporting and engagement.