# CISA Adds Three Known Exploited Vulnerabilities to Catalog

**URL:** <https://community.itbible.org/t/cisa-adds-three-known-exploited-vulnerabilities-to-catalog/2684>\
**Category:** Security Bulletins\
**Created:** [March 9, 2026, 6:25pm UTC](https://community.itbible.org/t/cisa-adds-three-known-exploited-vulnerabilities-to-catalog/2684 "2026-03-09T18:25:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Security](https://community.itbible.org/user_avatar/community.itbible.org/security/32/100_2.png) [@Security](https://community.itbible.org/u/Security)\
**Post date:** [March 9, 2026, 6:25pm UTC](https://community.itbible.org/t/cisa-adds-three-known-exploited-vulnerabilities-to-catalog/2684/1 "2026-03-09T18:25:17Z")

</div>

CISA has added three new vulnerabilities to its [Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog "Known Exploited Vulnerabilities Catalog"), based on evidence of active exploitation.

- [CVE-2021-22054](https://www.cve.org/CVERecord?id=CVE-2021-22054) Omnissa Workspace ONE Server-Side Request Forgery
- [CVE-2025-26399](https://www.cve.org/CVERecord?id=CVE-2025-26399) SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- [CVE-2026-1603](https://www.cve.org/CVERecord?id=CVE-2026-1603) Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

[Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01) established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the [BOD 22-01 Fact Sheet](https://www.cisa.gov/sites/default/files/publications/Reducing_the_Significant_Risk_of_Known_Exploited_Vulnerabilities_211103.pdf) for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of [KEV Catalog vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog "Known Exploited Vulnerabilities Catalog") as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the [specified criteria](https://www.cisa.gov/known-exploited-vulnerabilities "Reducing the Significant Risk of Known Exploited Vulnerabilities").

* * *
This is a companion discussion topic for the original entry at [https://www.cisa.gov/news-events/alerts/2026/03/09/cisa-adds-three-known-exploited-vulnerabilities-catalog](https://www.cisa.gov/news-events/alerts/2026/03/09/cisa-adds-three-known-exploited-vulnerabilities-catalog)