CISA Adds Six Exploited Vulnerabilities to KEV Catalog
Summary
CISA added six vulnerabilities to its KEV catalog. Reported exploitation includes Fortinet FortiClient EMS and Microsoft Exchange flaws; federal agencies must apply fixes by April 27, 2026.
Key points
- CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog.
- Fortinet FortiClient EMS flaw CVE-2026-21643 is an SQL injection; Defused Cyber reported detecting exploitation attempts since March 24, 2026.
- Microsoft says Storm-1175 has used Microsoft Exchange flaw CVE-2023-21529 to deliver Medusa ransomware.
- The other listed flaws affect Adobe Acrobat Reader, Windows CLFS, Host Process for Windows Tasks, and the VBA library.
- Microsoft previously acknowledged limited, targeted attacks against CVE-2012-1854; the article says the attacks’ nature is unknown.
- The article reports no public exploitation reports for the remaining three vulnerabilities.
- Federal Civilian Executive Branch agencies are required to apply fixes by April 27, 2026.
Article Details
- Event Type
- CISA added six vulnerabilities affecting Fortinet, Microsoft, and Adobe software to its Known Exploited Vulnerabilities catalog after citing evidence of active exploitation.
- Impact
- The flaws could enable code execution, privilege escalation, or other unauthorized actions. Defused Cyber reported exploitation attempts against CVE-2026-21643 since March 24, 2026; Microsoft reported that Storm-1175 weaponized CVE-2023-21529 to deliver Medusa ransomware. Microsoft also acknowledged limited, targeted attacks attempting to exploit CVE-2012-1854, while the article says there were no public exploitation reports for the other three vulnerabilities. Federal Civilian Executive Branch agencies were required to apply fixes by April 27, 2026.
CVE
CVE-2012-1854Microsoft · Office; Microsoft · Visual basic for applications; +1 moreOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).CVE-2020-9715Adobe · Adobe Acrobat and ReaderOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).CVE-2023-21529Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23; Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23; +2 moreMicrosoft reports threat actor Storm-1175 is weaponizing CVE-2023-21529 in attacks to deliver Medusa ransomware.CVE-2023-36424Microsoft · Windows 10 Version 1507; Microsoft · Windows 10 Version 1607; +21 moreOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).CVE-2025-60710Microsoft · Windows 11 24h2; Microsoft · Windows 11 25h2; +1 moreOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).CVE-2026-21643Fortinet · ForticlientemsCVE-2026-21643 is an SQL injection in Fortinet FortiClient EMS with exploitation attempts detected since March 24, 2026.
Threat Actors
Malware
Vendors
AdobeOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).FortinetNotable entries include an SQL injection in Fortinet FortiClient EMS observed being probed since March 24, 2026 and a Microsoft Exchange deserialization flaw that Microsoft says Storm-1175 has used to deliver MedusaMicrosoftinclude an SQL injection in Fortinet FortiClient EMS observed being probed since March 24, 2026 and a Microsoft Exchange deserialization flaw that Microsoft says Storm-1175 has used to deliver Medusa ransomware,
Products
Adobe Acrobat ReaderOther listed flaws affect Adobe Acrobat Reader (CVE-2020-9715), Windows CLFS driver (CVE-2023-36424), Host Process for Windows Tasks (CVE-2025-60710), and VBA library loading (CVE-2012-1854).FortiClient EMSNotable entries include an SQL injection in Fortinet FortiClient EMS observed being probed since March 24, 2026 and a Microsoft Exchange deserialization flaw that Microsoft says Storm-1175 has used to deliver MedusaMicrosoft Exchange ServerCVE-2023-21529 (CVSS score: 8.8) – A deserialization of untrusted data in Microsoft Exchange Server that could allow an authenticated attacker to achieve remote code execution.Microsoft Visual Basic for Applications (VBA)CVE-2012-1854 (CVSS score: 7.8) – An insecure library loading vulnerability in Microsoft Visual Basic for Applications (VBA) that could result in remote code execution.