cyber.hendryadrian.com
Security News · thecyberexpress.com

CISA Adds Eight Actively Exploited Vulnerabilities to KEV Catalog

· Original article ↗

Summary

CISA added eight actively exploited vulnerabilities to its KEV catalog on April 21, 2026, affecting products including PaperCut, TeamCity, Cisco Catalyst SD-WAN Manager and Zimbra. Federal remediation deadlines run from April to May.

Key points

  • The article reports that CISA added eight actively exploited vulnerabilities to the KEV catalog on April 21, 2026.
  • The additions affect PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE SMA, Zimbra Collaboration Suite and Cisco Catalyst SD-WAN Manager.
  • Three listed vulnerabilities affect Cisco Catalyst SD-WAN Manager, involving arbitrary file overwrite, recoverable passwords and sensitive information exposure.
  • The article links earlier exploitation of CVE-2023-27351 to Lace Tempest and deployment of Cl0p and LockBit ransomware.
  • CISA set federal remediation deadlines spanning April to May 2026 and recommends prioritizing KEV-listed vulnerabilities.
  • The article lists vendor patch versions for Zimbra vulnerabilities affecting multiple earlier releases.

Article Details

Event Type
CISA added eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on April 21, 2026.
Impact
The vulnerabilities affect PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance (SMA), Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager. Reported impacts include authentication bypass, path traversal, arbitrary file upload or overwrite, privilege escalation, credential exposure, sensitive-information exposure, and cross-site scripting. CISA set federal remediation deadlines spanning April to May 2026 and urged prioritized remediation.

CVE

CVE-2023-27351Papercut · Papercut mf; Papercut · Papercut ngFederal remediation deadlines for April–May 2026 accompany the update as CISA urges prioritized patching, noting past exploitation links like Lace Tempest using CVE-2023-27351 to deploy Cl0p and LockBit.CVE-2024-27198JetBrains · TeamCitySimilarly, CVE-2024-27199 follows an earlier related vulnerability, CVE-2024-27198, which was added to the KEV catalog in March 2024.CVE-2024-27199Jetbrains · TeamcityCVE-2023-27351 (PaperCut NG/MF) and CVE-2024-27199 (JetBrains TeamCity) are highlighted for ongoing exploitation and enterprise impact.CVE-2025-2749Kentico · XperienceCVE-2025-2749 (CVSS 7.2): A path traversal flaw in Kentico Xperience, permitting authenticated users to upload arbitrary data to specific paths via the Staging Sync Server.CVE-2025-32975Quest · Kace systems management applianceCVE-2025-32975 (CVSS 10.0): A critical improper authentication vulnerability in Quest KACE Systems Management Appliance (SMA), enabling attackers to impersonate legitimate users without credentials.CVE-2025-48700Synacor · Zimbra collaboration suiteCVE-2025-48700 is a high‑risk XSS in Zimbra Collaboration Suite impacting multiple versions and has vendor patches available.CVE-2026-20122Cisco · Catalyst sd-wan managerCVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information.CVE-2026-20128Cisco · Catalyst sd-wan managerCVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information.CVE-2026-20133Cisco · Catalyst sd-wan managerCVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information.

Threat Actors

TA505The article links Lace Tempest to exploitation of CVE-2023-27351 in April 2023 and reports that the vulnerability was used to deploy Cl0p and LockBit ransomware.

Malware

Cl0pFederal remediation deadlines for April–May 2026 accompany the update as CISA urges prioritized patching, noting past exploitation links like Lace Tempest using CVE-2023-27351 to deploy Cl0p and LockBit.LockBitFederal remediation deadlines for April–May 2026 accompany the update as CISA urges prioritized patching, noting past exploitation links like Lace Tempest using CVE-2023-27351 to deploy Cl0p and LockBit.

Vendors

Ciscoas PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and Cisco Catalyst SD‑WAN Manager.JetBrainsExploited Vulnerabilities (KEV) catalog on April 21, 2026, covering products such as PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and Cisco Catalyst SD‑WAN

Products

Cisco Catalyst SD-WAN ManagerCVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information.JetBrains TeamCityVulnerabilities (KEV) catalog on April 21, 2026, covering products such as PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and Cisco Catalyst SD‑WAN Manager.Kentico Xperienceproducts such as PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and Cisco Catalyst SD‑WAN Manager.PaperCut NG/MFto its Known Exploited Vulnerabilities (KEV) catalog on April 21, 2026, covering products such as PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and CiscoQuest KACE Systems Management Appliance (SMA)CVE-2025-32975 (CVSS 10.0): A critical improper authentication vulnerability in Quest KACE Systems Management Appliance (SMA), enabling attackers to impersonate legitimate users without credentials.Zimbra Collaboration SuiteApril 21, 2026, covering products such as PaperCut NG/MF, JetBrains TeamCity, Quest KACE SMA, Zimbra Collaboration Suite, Kentico Xperience, and Cisco Catalyst SD‑WAN Manager.

Related Articles