CISA Adds One Known Exploited Vulnerability to Catalog

CISA published multiple alerts in mid‑March 2026 adding several actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and urging rapid remediation under BOD 22‑01. Newly added CVEs span multiple products and vulnerability types (deserialization of untrusted data, cross‑site scripting, information disclosure, out‑of‑bounds write, authentication bypass, SSRF, etc.). CISA also issued an alert urging organizations to harden endpoint management systems following a March 11, 2026 attack that affected a U.S. organization, recommending least‑privilege RBAC, phishing‑‑