Cyble Weekly Report Tracks 1,675 Vulnerabilities and 10 KEV Additions
Summary
Cyble Research & Intelligence Labs tracked 1,675 vulnerabilities in a week; more than 205 had public PoCs and CISA added 10 to KEV. The report highlights enterprise, AI-tooling and ICS flaws, including actively exploited SharePoint.
Key points
- CRIL tracked 1,675 vulnerabilities in a week; more than 205 had publicly available proof-of-concept exploits.
- CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog; the report identifies SharePoint CVE-2026-32201 as actively exploited.
- The report highlights critical flaws in Microsoft SharePoint Server, Fortinet FortiClient EMS, Adobe ColdFusion and Microsoft Outlook.
- It reports rising exploitation of ShowDoc CVE-2025-0520 and large-scale targeting of more than 12,000 internet-exposed Flowise instances via CVE-2025-59528.
- OpenClaw CVE-2026-35652 is described as an authorization bypass that could allow unauthenticated manipulation of restricted agent actions.
- CISA issued three ICS advisories covering four vulnerabilities; the Contemporary Controls BASControl20 flaw has no patch, with replacement or network isolation cited as options.
- Recommendations include prioritizing KEV-listed flaws, patching exposed systems, segmenting IT and OT networks, and isolating or replacing obsolete devices.
Article Details
- Publisher
- Cyble Research & Intelligence Labs (CRIL)
- Report Period
- Weekly report; describes the reporting period as “last week” and references April 2026 exploitation activity.
- Scope
- Vulnerability disclosures, exploitation activity, CISA KEV additions, and industrial control system advisories across enterprise, cloud, AI, developer, and OT environments.
- Sample Size
- 1,675 vulnerabilities tracked during the week.
- Key Statistics
- More than 205 tracked vulnerabilities had publicly available PoC exploits.
- CISA added 10 vulnerabilities to its KEV catalog.
- 111 vulnerabilities were rated critical under CVSS v3.1; 34 were rated critical under CVSS v4.0.
- Three CISA ICS advisories covered four vulnerabilities.
- Flowise exploitation reportedly targeted more than 12,000 internet-exposed instances.
- Recommendations
- Prioritize remediation of KEV-listed vulnerabilities.
- Patch externally exposed enterprise systems and collaboration platforms.
- Secure AI agents, automation tools, and developer workflows.
- Segment IT and OT environments to reduce lateral movement.
- Replace or isolate obsolete industrial devices without available patches.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterReported remote code execution and malicious payload execution support use of command or scripting interpreters.T1068 · Exploitation for Privilege EscalationThe report says an attacker with minimal access could escalate privileges by exploiting Mitsubishi Electric vulnerabilities and harvested credentials.T1190 · Exploit Public-Facing ApplicationThe report describes active exploitation of vulnerabilities in internet-facing services and targeting of unpatched servers.T1505.003 · Web ShellAttackers are reportedly deploying web shells on unpatched ShowDoc servers.
CVE
CVE-2025-0520ShowDoc · ShowDocCVE-2025-0520 — ShowDoc (Critical)CVE-2025-13926Contemporary Controls · BASControl20CVE-2025-13926 — Contemporary Controls BASControl20 (Critical)CVE-2025-14815Mitsubishi Electric Corporation · AnalytiX; Mitsubishi Electric Corporation · GENESIS; +11 moreCVE-2025-14815 / CVE-2025-14816 — Mitsubishi Electric Platforms (High)CVE-2025-14816Mitsubishi Electric Corporation · AnalytiX; Mitsubishi Electric Corporation · GENESIS; +11 moreCVE-2025-14815 / CVE-2025-14816 — Mitsubishi Electric Platforms (High)CVE-2025-59528Flowiseai · FlowiseCVE-2025-59528 — Flowise (Critical)CVE-2026-1340Ivanti · Endpoint Manager MobileCVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM)CVE-2026-21643Fortinet · ForticlientemsCritical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.CVE-2026-27304Adobe · ColdFusion 2023; Adobe · ColdFusion 2025CVE-2026-27304 — Adobe ColdFusion (Critical)CVE-2026-29145Apache · Tomcat; Apache · Tomcat nativeCVE-2026-29145 — Microsoft 365 Outlook Desktop Client (Critical)CVE-2026-32201Microsoft · Sharepoint serverCritical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.CVE-2026-35652OpenClaw · OpenClawCVE-2026-35652 — OpenClaw AI Agent Framework (High)CVE-2026-4436GPL Odorizers · GPL Odorizers GPL750 (XL7 Prime); GPL Odorizers · GPL Odorizers GPL750 (XL7); +2 moreCVE-2026-4436 — GPL Odorizers (High)
Vendors
Adobecompromise vectors – Microsoft SharePoint Server, Fortinet FortiClient EMS, OpenClaw AI Agent Framework, Adobe ColdFusion (examples from top flaws).Contemporary ControlsIndustrial control exposures persist: CISA issued ICS advisories for Contemporary Controls, Mitsubishi Electric, and GPL Odorizers, with some devices unpatchable and requiring isolation or replacement.FortinetCritical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.GPL OdorizersIndustrial control exposures persist: CISA issued ICS advisories for Contemporary Controls, Mitsubishi Electric, and GPL Odorizers, with some devices unpatchable and requiring isolation or replacement.IvantiCVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM)MicrosoftCritical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.Mitsubishi ElectricIndustrial control exposures persist: CISA issued ICS advisories for Contemporary Controls, Mitsubishi Electric, and GPL Odorizers, with some devices unpatchable and requiring isolation or replacement.
Products
Adobe ColdFusionvectors – Microsoft SharePoint Server, Fortinet FortiClient EMS, OpenClaw AI Agent Framework, Adobe ColdFusion (examples from top flaws).BASControl20CVE-2025-13926 — Contemporary Controls BASControl20 (Critical)FlowiseAI frameworks and developer tooling (OpenClaw, Flowise, ShowDoc) are increasingly targeted, with large-scale RCE exploitation and web shell deployments reported.FortiClient EMSCritical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.Ivanti Endpoint Manager Mobile (EPMM)CVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM)Microsoft 365 Outlook desktop clientCVE-2026-29145 — Microsoft 365 Outlook Desktop Client (Critical)Microsoft SharePoint Serverproduct / system ] Notable targeted software and systems referenced as compromise vectors – Microsoft SharePoint Server, Fortinet FortiClient EMS, OpenClaw AI Agent Framework, Adobe ColdFusion (examples from topOpenClawAI frameworks and developer tooling (OpenClaw, Flowise, ShowDoc) are increasingly targeted, with large-scale RCE exploitation and web shell deployments reported.ShowDocAI frameworks and developer tooling (OpenClaw, Flowise, ShowDoc) are increasingly targeted, with large-scale RCE exploitation and web shell deployments reported.