CISA adds one of a pair of code injection vulnerabilities to KEV Catalog as experts warn, “this is not a drill”.