CVE-2026-64849

CISA added CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability affecting MLflow Server, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The article provides no technical detail on the exploitation method, affected versions, or observed attacker infrastructure, and instead focuses on remediation obligations under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.