CISA announced on November 13, 2026 that it has added two new entries to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The catalog now includes CVE-2026-114713, an Improper Neutralization of Delimiters vulnerability in UnrealIRCd, and CVE-2026-123039, a Multiple Products Incorrect Permission Assignment for Critical Resource vulnerability affecting Check Point products. The agency cites these flaws as frequent attack vectors that pose significant risks to the federal enterprise. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of high-risk KEV items on publicly exposed assets that grant total control post-exploitation, while lower-risk issues may be deferred. Although BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation. Agencies can submit additional exploited CVEs for possible catalog inclusion via the KEV Nomination Form. 1