CYBERSECURITYApril 14, 20261 min read17 views

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation across major platforms.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The list of vulnerabilities is as follows -

CVE-2026-21643(CVSS score: 9.1) - An SQL injection vulnerability in Fortinet FortiClient EMS that could allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.CVE-2020-9715(CVSS score: 7.8) - A use-after-free vulnerability in Adobe Acrobat Reader that could result in remote code execution.CVE-2023-36424(CVSS score: 7.8) - An out-of-bounds read vulnerability in Microsoft Windows Common Log File System Driver that could result in privilege escalation.CVE-2023-21529(CVSS score: 8.8) - A deserialization of untrusted data in Microsoft Exchange Server that could allow an authenticated attacker to achieve remote code execution.CVE-2025-60710(CVSS score: 7.8) - An improper link resolution before file access vulnerability in Host Process for Windows Tasks that could allow an authorized attacker to elevate privileges locally.CVE-2012-1854(CVSS score: 7.8) - An insecure library loading vulnerability in Microsoft Visual Basic for Applications (VBA) that could result in remote code execution.

The addition of CVE-2026-21643 to the KEV catalog comes after Defused Cyber said it detected exploitation attempts targeting the flaw since March 24, 2026. Last week, Microsoft revealed that a threat actor it tracks as Storm-1175 has been weaponizing CVE-2023-21529 in attacks to deliver Medusa ransomware.

As for CVE-2012-1854, the Windows makeracknowledged in an advisory released in July 2012 that it's aware of "limited, targeted attacks" attempting to abuse the vulnerability. The exact nature of the attacks is presently unknown.

There are currently no public reports referencing the exploitation of the remaining three vulnerabilities. In light of active attacks, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by April 27, 2026.

Source: The Hacker News

More in this category

cybersecurity

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a massive campaign named FakeGit, leveraging thousands of malicious GitHub repositories to distribute SmartLoader malware. The campaign features a novel technique called AgentBaiting, which tricks AI agents into executing malicious instructions autonomously.

cybersecurity

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A mere 11-byte TLS request can force an unpatched OpenSSL server to allocate up to 131 KB of memory that is never released. OpenSSL silently patched this "HollowByte" vulnerability without issuing a CVE or security advisory.

cybersecurity

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.

cybersecurity

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog, which compromised DigiCert's support portal to steal and abuse code-signing certificates.

cybersecurity

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia has detained a Russian tourist on a U.S. extradition warrant targeting a REvil ransomware suspect. However, defense lawyers argue it is a case of mistaken identity caused by incomplete name details in the U.S. warrant.

cybersecurity

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an active infostealer, is targeting enterprise networks using sophisticated 'ClickFix' social engineering lures. By tricking users into pasting malicious commands into the Run dialog, attackers can easily steal session tokens, browser credentials, and sensitive documents from OneDrive and SharePoint.