CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe, Fortinet)
CISA KEV Catalog Update (TL-2026-0357), also tracked as CISA KEV April 2026 Batch, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-13. It has no confirmed attribution, affects Fortinet FortiClient EMS, references 7 CVEs (CVE-2012-1854, CVE-2025-60710, CVE-2023-21529), maps to 14 MITRE ATT&CK techniques (T1059.005, T1068, T1082), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0357
- Threat ID
- TL-2026-0357
- Also known as
- CISA KEV April 2026 Batch, CISA KEV 2026-04-13 Additions, KEV-0413-2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-13
- Last reviewed
- 2026-04-13
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, federal-civilian, financial, healthcare, defense-industrial-base, energy, technology, managed-service-providers
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 17
CISA added seven vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-13 based on confirmed active exploitation evidence. The batch spans Microsoft (VBA, Windows, Exchange), Adobe (Acrobat/Reader), and Fortinet (FortiClient EMS), and includes an unauthenticated SQL injection in FortiClient EMS (CVE-2026-21643) with a three-day federal remediation deadline.
How CISA KEV Catalog Update works
On 2026-04-13, the Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, triggering Binding Operational Directive (BOD) 22-01 remediation requirements across federal civilian agencies. The batch represents a cross-vendor cluster of actively exploited weaknesses affecting productivity software, endpoint management infrastructure, enterprise mail servers, and the core Windows operating system.
The most urgent entry is CVE-2026-21643, an unauthenticated SQL injection in Fortinet FortiClient EMS (CWE-89) disclosed in Fortinet PSIRT advisory FG-IR-25-1142. FortiClient EMS operates as the central management plane for Fortinet's endpoint security stack inside enterprise networks, and the flaw allows a remote attacker to execute unauthorized code or commands via crafted HTTP requests without authentication. CISA assigned the CVE an accelerated remediation deadline of 2026-04-16 — three days from the KEV add date — indicating observed in-the-wild exploitation of internet-exposed EMS instances. This parallels the 2024 FortiClient EMS SQLi (CVE-2023-48788) pattern that was weaponized for initial access into managed endpoints.
Two Adobe Acrobat memory-corruption flaws are included: CVE-2020-9715 (use-after-free, CWE-416, originally patched in APSB20-48) and CVE-2026-34621 (prototype pollution, CWE-1321, patched in APSB26-43). Both enable arbitrary code execution when a user opens a malicious PDF, making them first-stage payloads in spearphishing and watering-hole operations. Adobe Acrobat has been a historically reliable attack surface for targeted intrusions by both cybercrime and nation-state operators.
Three Microsoft entries cover Windows and Exchange. CVE-2012-1854 is a legacy but re-weaponized Microsoft VBA insecure library loading flaw (CWE-426) addressed in MS12-046 that allows remote code execution via DLL side-loading when a user opens a trojanized Office document from a working directory controlled by the attacker. CVE-2023-21529 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Exchange Server allowing authenticated remote code execution — typically chained with valid credentials obtained through phishing or credential stuffing. CVE-2023-36424 is an out-of-bounds read (CWE-125) in the Windows Common Log File System (CLFS) driver that allows local privilege escalation to SYSTEM. CVE-2025-60710 rounds out the Windows set with a link following vulnerability (CWE-59) enabling privilege escalation via symbolic link abuse.
Together, these CVEs form a realistic intrusion chain: FortiClient EMS SQLi for initial access to the endpoint management plane, Adobe Acrobat or VBA exploitation for initial code execution on user workstations, Windows CLFS and link-following flaws for local privilege escalation to SYSTEM, and Exchange deserialization for lateral movement to the mail tier. Federal agencies must remediate CVE-2026-21643 by 2026-04-16 and the remaining six by 2026-04-27. Private-sector defenders should treat all seven as immediate patching priorities and hunt for the behavioral indicators described in the Detections section.
MITRE ATT&CK techniques used in TL-2026-0357
Execution
T1059.005 Command and Scripting Interpreter: Visual Basic; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1212 Exploitation for Credential Access
defense-impairment
Impact
T1486 Data Encrypted for Impact
stealth
Affected products and versions in CISA KEV Catalog Update
- Fortinet — FortiClient EMS
Vulnerable versions: All versions prior to fixed builds referenced in FG-IR-25-1142
Fixed in: Per Fortinet PSIRT FG-IR-25-1142 - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022; Windows Server 2025
Fixed in: Systems with November 2023 and October 2025 cumulative updates applied - Microsoft — Exchange Server
Vulnerable versions: Exchange Server 2016 CU23; Exchange Server 2019 CU11/CU12
Fixed in: Exchange Server 2016 CU23 with SU Feb 2023; Exchange Server 2019 CU12 with SU Feb 2023 - Microsoft — Visual Basic for Applications (VBA)
Vulnerable versions: Office 2003; Office 2007; Office 2010; Visual Basic 6.0 Runtime
Fixed in: Systems with MS12-046 applied - Adobe — Acrobat
Vulnerable versions: Acrobat DC prior to 2020.012.20048; Acrobat 2020 prior to 2020.001.30005; Acrobat 2017 prior to 2017.011.30175
Fixed in: Per APSB20-48 - Adobe — Acrobat and Reader
Vulnerable versions: Acrobat DC prior to APSB26-43 build; Reader DC prior to APSB26-43 build
Fixed in: Per Adobe APSB26-43
Remediation for CISA KEV Catalog Update
Patches
- Fortinet: FortiClient EMS fixed builds per FG-IR-25-1142
- Microsoft: MS12-046 (CVE-2012-1854), MSRC advisory for CVE-2025-60710, CVE-2023-21529, CVE-2023-36424
- Adobe: APSB20-48 (CVE-2020-9715), APSB26-43 (CVE-2026-34621)
Immediate actions
- Apply Fortinet FortiClient EMS patch per FG-IR-25-1142 before the 2026-04-16 federal deadline
- Restrict FortiClient EMS management interface to trusted management networks only; block external exposure at the perimeter
- Apply Adobe Acrobat/Reader APSB26-43 update to all endpoints and force restart of active Reader instances
- Apply Microsoft patches for CVE-2025-60710, CVE-2023-21529, CVE-2023-36424 and confirm KB installation across the fleet
- Disable VBA macro execution from untrusted locations via Group Policy to mitigate CVE-2012-1854
- Hunt for exploitation indicators across EDR, mail, and web proxy telemetry for the prior 30 days
Workarounds
- For CVE-2026-21643: block unauthenticated HTTP/HTTPS access to FortiClient EMS at the network edge
- For Acrobat CVEs: disable JavaScript in Acrobat/Reader and enable Protected Mode
- For CVE-2012-1854: set safe DLL search mode registry key (CWDIllegalInDllSearch)
- For CVE-2023-21529: require Extended Protection on Exchange and strip unauthenticated access to ECP/OWA
Longer-term hardening
- Enforce BOD 22-01 patch SLAs for all CISA KEV entries on internal non-federal systems as internal policy
- Deploy attack surface management to continuously inventory internet-exposed Fortinet, Exchange, and other enterprise management planes
- Adopt Protected View / Application Guard for Office to contain VBA and document-borne exploit chains
- Migrate Exchange workloads to Exchange Online or Exchange Server 2019 CU with Extended Protection enabled
- Implement application control (WDAC/AppLocker) to block unsigned DLL side-loading
CVEs associated with CISA KEV Catalog Update
CVE-2012-1854, CVE-2025-60710, CVE-2023-21529, CVE-2023-36424, CVE-2020-9715, CVE-2026-21643, CVE-2026-34621
Weaknesses (CWE) in CISA KEV Catalog Update
CWE-426, CWE-59, CWE-502, CWE-125, CWE-416, CWE-89, CWE-1321
Timeline of CISA KEV Catalog Update
- Microsoft publishes MS12-046 patching CVE-2012-1854 VBA insecure library loading vulnerability
- Adobe publishes APSB20-48 patching CVE-2020-9715 Acrobat use-after-free
- Microsoft February 2023 Patch Tuesday addresses CVE-2023-21529 Exchange Server deserialization RCE
- Microsoft November 2023 Patch Tuesday addresses CVE-2023-36424 Windows CLFS out-of-bounds read
- Microsoft October 2025 Patch Tuesday addresses CVE-2025-60710 Windows link following privilege escalation
- Fortinet publishes PSIRT advisory FG-IR-25-1142 disclosing CVE-2026-21643 FortiClient EMS unauthenticated SQL injection
- Adobe publishes APSB26-43 addressing CVE-2026-34621 Acrobat and Reader prototype pollution RCE
- CISA adds all seven CVEs to the Known Exploited Vulnerabilities catalog based on active exploitation evidence
- Federal remediation deadline for CVE-2026-21643 FortiClient EMS (three-day accelerated timeline)
- Federal remediation deadline for remaining six CVEs in the batch per BOD 22-01
- As of 2026-05-29, this CISA KEV batch remains actively exploited: FortiClient EMS SQLi CVE-2026-21643 saw 51+ attacking IPs through late April with ~1000 instances still exposed on Shodan, and Adobe Acrobat CVE-2026-34621 has been exploited since Dec 2025. Patches exist for all seven CVEs but in-the-wild exploitation of unpatched systems continues.
Sources cited for CISA KEV Catalog Update
- CISA Known Exploited Vulnerabilities Catalog
- CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities
- Fortinet PSIRT FG-IR-25-1142: FortiClient EMS SQL Injection
- Microsoft Security Bulletin MS12-046: Vulnerability in Visual Basic for Applications
- MSRC Advisory CVE-2025-60710: Windows Link Following Vulnerability
- MSRC Advisory CVE-2023-21529: Exchange Server RCE
- MSRC Advisory CVE-2023-36424: Windows CLFS OOB Read
- Adobe Security Bulletin APSB20-48: Security update for Adobe Acrobat and Reader
- Adobe Security Bulletin APSB26-43: Security update for Adobe Acrobat and Reader
- NVD: CVE-2026-21643
- NVD: CVE-2026-34621
- NVD: CVE-2023-21529
- NVD: CVE-2023-36424
- NVD: CVE-2025-60710
- NVD: CVE-2020-9715
Threats related to CISA KEV Catalog Update
Detection coverage for TL-2026-0357
As of 2026-04-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0357 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.