CISA

The Cybersecurity and Infrastructure Security Agency (CISA) maintained active KEV obligations throughout this update window, adding nine CVEs including CitrixBleed 3, F5 BIG-IP APM's reclassified RCE, a 17-year-old Microsoft Office bug, a Fortinet SQL injection and a SharePoint spoofing zero-day. Against that operational tempo, the Trump FY27 budget proposal published on 7 April 2026 proposes cutting CISA's budget by $707 million, eliminating 860 positions, and reducing the agency to approximately $2 billion in operating budget.

CISA was established in 2018 as the federal lead for protecting critical infrastructure and federal civilian networks. Its Known Exploited Vulnerabilities catalogue is the primary operational mechanism for communicating mandatory patch obligations to Federal Civilian Executive Branch agencies and voluntary urgency signals to private-sector organisations. The counter-ransomware initiative, which coordinated federal response to Colonial Pipeline and other Major incidents, has already been cancelled under earlier 2025-2026 CISA staffing reductions.

The structural tension is acute: CISA's KEV catalogue is growing, the adversary tempo documented in this update (Salt Typhoon confirmed ongoing, BRICKSTORM 393-day dwell, CitrixBleed 3) is accelerating, and the proposed budget would reduce CISA to roughly two-thirds of its current capacity. For private-sector organisations, a thinner CISA means fewer co-ordinated incident responses, reduced JCDC engagement and a narrower threat-intelligence sharing infrastructure at the federal layer.