CISA 2026-04-13

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

Machine-generated analysis · WAYSCloud LLM

The advisory adds a 2012-era Visual Basic for Applications vulnerability back into active exploitation focus, suggesting long-dormant attack methods may still pose current risk.

Context

The advisory lists seven newly added vulnerabilities to CISA's Known Exploited Vulnerabilities Catalog, including older and newer flaws in widely used software such as Microsoft Windows, Microsoft Exchange Server, Adobe Acrobat, and Fortinet products. Each of these vulnerabilities is included due to evidence of active exploitation in the wild. Notably, CVE-2012-1854 involves insecure library loading in Microsoft Visual Basic for Applications, a vulnerability type historically leveraged through malicious documents. The advisory does not specify exploit methods, affected sectors, or attacker identities.

Operator considerations

Check: whether Microsoft Visual Basic for Applications, Adobe Acrobat, Microsoft Exchange Server, or Fortinet products are in use.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2012-1854 Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

CVE-2020-9715 Adobe Acrobat Use-After-Free Vulnerability

CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read Vulnerability

CVE-2025-60710 Microsoft Windows Link Following Vulnerability

CVE-2026-21643 Fortinet SQL Injection Vulnerability

CVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities establishe...

Read the full advisory on CISA →