# CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe, Fortinet)

> CISA added seven vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-13 based on confirmed active exploitation evidence. The batch spans Microsoft (VBA, Windows, Exchange), Adobe (Acrobat/Reader), and Fortinet (FortiClient EMS), and includes an unauthenticated SQL injection in FortiClient EMS (CVE-2026-21643) with a three-day federal remediation deadline.

- **Published:** 2026-04-13T12:00:00Z
- **Last reviewed:** 2026-04-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0357
- **ID:** TL-2026-0357
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2012-1854, CVE-2025-60710, CVE-2023-21529, CVE-2023-36424, CVE-2020-9715, CVE-2026-21643, CVE-2026-34621

## Description

On 2026-04-13, the Cybersecurity and Infrastructure Security Agency (CISA) added seven vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, triggering Binding Operational Directive (BOD) 22-01 remediation requirements across federal civilian agencies. The batch represents a cross-vendor cluster of actively exploited weaknesses affecting productivity software, endpoint management infrastructure, enterprise mail servers, and the core Windows operating system.

The most urgent entry is CVE-2026-21643, an unauthenticated SQL injection in Fortinet FortiClient EMS (CWE-89) disclosed in Fortinet PSIRT advisory FG-IR-25-1142. FortiClient EMS operates as the central management plane for Fortinet's endpoint security stack inside enterprise networks, and the flaw allows a remote attacker to execute unauthorized code or commands via crafted HTTP requests without authentication. CISA assigned the CVE an accelerated remediation deadline of 2026-04-16 — three days from the KEV add date — indicating observed in-the-wild exploitation of internet-exposed EMS instances. This parallels the 2024 FortiClient EMS SQLi (CVE-2023-48788) pattern that was weaponized for initial access into managed endpoints.

Two Adobe Acrobat memory-corruption flaws are included: CVE-2020-9715 (use-after-free, CWE-416, originally patched in APSB20-48) and CVE-2026-34621 (prototype pollution, CWE-1321, patched in APSB26-43). Both enable arbitrary code execution when a user opens a malicious PDF, making them first-stage payloads in spearphishing and watering-hole operations. Adobe Acrobat has been a historically reliable attack surface for targeted intrusions by both cybercrime and nation-state operators.

Three Microsoft entries cover Windows and Exchange. CVE-2012-1854 is a legacy but re-weaponized Microsoft VBA insecure library loading flaw (CWE-426) addressed in MS12-046 that allows remote code execution via DLL side-loading when a user opens a trojanized Office document from a working directory controlled by the attacker. CVE-2023-21529 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Exchange Server allowing authenticated remote code execution — typically chained with valid credentials obtained through phishing or credential stuffing. CVE-2023-36424 is an out-of-bounds read (CWE-125) in the Windows Common Log File System (CLFS) driver that allows local privilege escalation to SYSTEM. CVE-2025-60710 rounds out the Windows set with a link following vulnerability (CWE-59) enabling privilege escalation via symbolic link abuse.

Together, these CVEs form a realistic intrusion chain: FortiClient EMS SQLi for initial access to the endpoint management plane, Adobe Acrobat or VBA exploitation for initial code execution on user workstations, Windows CLFS and link-following flaws for local privilege escalation to SYSTEM, and Exchange deserialization for lateral movement to the mail tier. Federal agencies must remediate CVE-2026-21643 by 2026-04-16 and the remaining six by 2026-04-27. Private-sector defenders should treat all seven as immediate patching priorities and hunt for the behavioral indicators described in the Detections section.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1204.002 User Execution: Malicious File
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1574.001 DLL
- T1068 Exploitation for Privilege Escalation
- T1574.001 DLL
- T1211 Exploitation for Stealth
- T1222.001 Windows Permissions
- T1212 Exploitation for Credential Access
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1486 Data Encrypted for Impact

## Sources

- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities)
- [Fortinet PSIRT FG-IR-25-1142: FortiClient EMS SQL Injection](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142)
- [Microsoft Security Bulletin MS12-046: Vulnerability in Visual Basic for Applications](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046)
- [MSRC Advisory CVE-2025-60710: Windows Link Following Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710)
- [MSRC Advisory CVE-2023-21529: Exchange Server RCE](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529)
- [MSRC Advisory CVE-2023-36424: Windows CLFS OOB Read](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424)
- [Adobe Security Bulletin APSB20-48: Security update for Adobe Acrobat and Reader](https://helpx.adobe.com/security/products/acrobat/apsb20-48.html)
- [Adobe Security Bulletin APSB26-43: Security update for Adobe Acrobat and Reader](https://helpx.adobe.com/security/products/acrobat/apsb26-43.html)
- [NVD: CVE-2026-21643](https://nvd.nist.gov/vuln/detail/CVE-2026-21643)
- [NVD: CVE-2026-34621](https://nvd.nist.gov/vuln/detail/CVE-2026-34621)
- [NVD: CVE-2023-21529](https://nvd.nist.gov/vuln/detail/CVE-2023-21529)
- [NVD: CVE-2023-36424](https://nvd.nist.gov/vuln/detail/CVE-2023-36424)
- [NVD: CVE-2025-60710](https://nvd.nist.gov/vuln/detail/CVE-2025-60710)
- [NVD: CVE-2020-9715](https://nvd.nist.gov/vuln/detail/CVE-2020-9715)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0357