The Cybersecurity and Infrastructure Security Agency (CISA) has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws, affecting core Windows and Microsoft Office frameworks, are being actively leveraged by state-sponsored actors to bypass shell protections and elevate privileges.

• Action Required: Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate these vulnerabilities by the specified deadline to maintain compliance with Binding Operational Directive 22-01.

• Key Threat: CVE-2026-21533 (Remote Desktop Services Elevation of Privilege).