CISA Director Jen Easterly expects the agency to finish full deployment of its automated vulnerability warning program by the end of the year. This software pilot, which began in January 2023 under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, has already sent over 2,000 warnings regarding software flaws to nearly 7,000 organizations. I find the scale of this expansion impressive. The program uses scanning tools to notify businesses about vulnerabilities that ransomware gangs actively target. While many recipients already use CISA cyber hygiene scanning tools, the agency can also warn entities appearing on Shodan or other internet-scanning services.
Rapid remediation via KEV updates
CISA continues to update its Known Exploited Vulnerabilities (KEV) Catalog as evidence of active exploitation emerges. On September 25, 2026, the agency added one new vulnerability to the catalog. In October 2026, CISA added another single vulnerability based on similar evidence. These updates trigger requirements under Binding Operational Directive 26-04, which mandates that Federal Civilian Executive Branch agencies prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets. Specifically, these agencies must address CVEs listed in the KEV Catalog that grant total control of an asset post-exploitation.
| Vulnerability Type | Target Requirement |
|---|---|
| KEV-listed flaws | Prioritize rapid remediation |
| High-risk public assets | Total control post-exploitation |
| FCEB Agency mandate | Check for prior compromise |
The agency encourages all organizations to adopt risk-based management and prioritize KEV items. You should treat KEV entries on internet-facing systems as emergency patches. However, the directive only applies to federal agencies, leaving private entities to follow voluntary guidance. One recent addition to the KEV catalog involved a WordPress Core flaw, CVE-2026-119977, which carries a CVSS score of 8.1. This flaw allows attackers to achieve arbitrary code execution during software upgrades.
Early detection through notifications
The Pre-Ransomware Notifications initiative aims to alert organizations during the window between initial network access and data encryption. This time-lapse often lasts from hours to days. Since the start of 2023, CISA notified over 60 entities in sectors like energy, healthcare, and education about early-stage attacks. The Joint Cyber Defense Collaborative collects intelligence from infrastructure providers and threat intelligence firms to feed this process. Field personnel then contact victim organizations to provide specific mitigation guidance. This method helps victims evict actors before they encrypt critical data. Will these notifications reach small businesses as effectively as they reach large infrastructure providers?
