CISA Adds 7 KEV CVEs (Microsoft, Adobe, Fortinet): Patch What’s Actively Exploited

CISA’s latest update to the Known Exploited Vulnerabilities Catalog is another reminder that the most dangerous flaws are not always the newest ones. On April 13, 2026, the agency added seven CVEs spanning Microsoft, Adobe, and Fortinet, and it did so because there is evidence the flaws are being actively exploited in the wild. For defenders, that makes the announcement less about abstract severity scores and more about immediate exposure.
The list is especially notable because it mixes older, familiar attack patterns with newer enterprise-facing weaknesses. It includes CVE-2012-1854 in Microsoft Visual Basic for Applications, CVE-2020-9715 in Adobe Acrobat, CVE-2023-21529 in Microsoft Exchange Server, CVE-2023-36424 in Windows, CVE-2025-60710 in Windows, CVE-2026-21643 in Fortinet, and CVE-2026-34621 in Adobe Acrobat and Reader. CISA says these kinds of vulnerabilities are frequent attack vectors and urges all organizations to prioritize remediation, not just federal agencies bound by the directive.
What makes this update important is not just the size of the batch, but the story it tells about attacker behavior. The KEV Catalog is designed to track vulnerabilities that have moved from theoretical risk into operational reality, and CISA’s criteria emphasize reliable evidence of active exploitation. In other words, this is the shortlist defenders should treat as a live-fire problem, not a compliance exercise.

Background​

CISA’s Known Exploited Vulnerabilities Catalog was created under Binding Operational Directive 22-01, which established a living list of CVEs that pose significant risk to the federal enterprise. The premise is simple: patching every vulnerability in every environment at equal speed is unrealistic, so defenders need a way to rank the vulnerabilities attackers are actually using. CISA’s directive formalized that prioritization model and tied it to remediation deadlines for Federal Civilian Executive Branch agencies.
That approach reflects a broader shift in cybersecurity strategy. For years, organizations treated CVSS scores as the main yardstick for urgency, but severity alone does not tell defenders whether adversaries are exploiting a flaw right now. CISA’s own guidance notes that many critical vulnerabilities are never seen in real-world exploitation, while a smaller subset becomes a repeated entry point for intrusion campaigns. The KEV list exists to surface that practical difference.
The federal requirement matters because government networks are not the only likely targets. The KEV Catalog has become a de facto prioritization signal for enterprises, MSPs, schools, hospitals, and critical infrastructure operators that need to make faster patch decisions with limited staff. CISA explicitly urges all organizations to use the catalog as part of their vulnerability management process, even though the binding deadline applies only to FCEB agencies.
The latest batch also fits a familiar pattern in public reporting on exploited vulnerabilities. Email servers, document readers, and internet-facing security appliances continue to dominate the attack surface because they are both ubiquitous and reachable. Once one of those systems is compromised, adversaries often gain a foothold that can be used for credential theft, lateral movement, or follow-on ransomware operations. That is why even an older bug such as CVE-2012-1854 can still be operationally relevant in 2026.
Another important angle is the diversity of vendors involved. Microsoft and Adobe vulnerabilities are common in enterprise desktops and back-office systems, while Fortinet flaws often matter because of edge-device exposure and firewall placement. This means the new KEV additions touch not just one layer of the stack but several different control planes that defenders need to treat differently.

Why the KEV Catalog matters​

The KEV Catalog is often misunderstood as just another vulnerability database. It is not. It is a curated operational list based on active exploitation, and that distinction makes it more useful for real-world prioritization than a raw inventory of disclosed CVEs.
For security teams, that means the list can function as a forcing mechanism. Patch windows, exception processes, asset inventories, and compensating controls all become easier to justify when the vulnerability is already known to be under attack. That is the point of the catalog: not to tell you everything that could be dangerous, but to tell you what is dangerous right now.

---

What CISA Added​

The seven new entries span multiple vendors and exploitation classes, which is a sign that attackers are not relying on a single technique or product family. CISA’s notice lists Microsoft Visual Basic for Applications insecure library loading, Adobe Acrobat use-after-free, Microsoft Exchange Server deserialization of untrusted data, Microsoft Windows out-of-bounds read, Microsoft Windows link following, Fortinet SQL injection, and Adobe Acrobat and Reader prototype pollution. That spread is significant because it touches client software, collaboration infrastructure, endpoint OS behavior, and perimeter appliances.
Two of the entries are particularly noteworthy from a defender’s perspective. The Exchange Server issue, CVE-2023-21529, fits a long-running pattern of attackers targeting mail infrastructure because it provides deep access to identities, messages, and internal workflows. The Fortinet flaw, CVE-2026-21643, is also the kind of issue that can turn a security device into a high-value pivot point if it sits at the network edge.
The Adobe entries are not surprising, but they are still important. Adobe Acrobat and Reader continue to be frequent targets because PDF files remain a reliable delivery mechanism for malicious content, and use-after-free or prototype pollution bugs often provide the sort of memory corruption that attackers can turn into code execution. CISA’s decision to add both CVE-2020-9715 and CVE-2026-34621 reinforces how persistent document-based exploitation remains.

The seven CVEs at a glance​

Here is the list CISA added on April 13, 2026:

• CVE-2012-1854 — Microsoft Visual Basic for Applications insecure library loading vulnerability.
• CVE-2020-9715 — Adobe Acrobat use-after-free vulnerability.
• CVE-2023-21529 — Microsoft Exchange Server deserialization of untrusted data vulnerability.
• CVE-2023-36424 — Microsoft Windows out-of-bounds read vulnerability.
• CVE-2025-60710 — Microsoft Windows link following vulnerability.
• CVE-2026-21643 — Fortinet SQL injection vulnerability.
• CVE-2026-34621 — Adobe Acrobat and Reader prototype pollution vulnerability.

The mix of years is also telling. CISA is not only reacting to shiny new issues from 2026; it is still elevating vulnerabilities from 2012, 2020, and 2023 because exploitation persists long after disclosure. That is a reminder that patch backlog, not disclosure date, determines real-world exposure. Old does not mean safe.

Exploitation patterns behind the entries​

The underlying techniques matter because they shape remediation strategy. Library loading problems, use-after-free bugs, deserialization flaws, and SQL injection each imply different attack chains and different ways to mitigate risk. A broad patch strategy is necessary, but it is rarely sufficient on its own.
In practical terms, that means defenders need to think beyond “install update” and ask where the vulnerable software lives, how exposed it is, and whether there are compensating controls. For example, a vulnerable Adobe installation on a locked-down workstation is not the same risk as the same software on a public-facing kiosk or a heavily used shared machine. Context matters.

---

Microsoft Exposure and Enterprise Risk​

Microsoft appears in three of the seven newly added CVEs, which is a reminder of how often the Windows ecosystem sits at the center of enterprise exposure. The affected components span legacy application behavior, mail infrastructure, and the Windows operating system itself. That breadth matters because a patch gap in one layer can open paths to compromise across the environment.
The Exchange Server vulnerability, CVE-2023-21529, is the most obvious enterprise risk because Exchange has long been a high-value target for both nation-state and financially motivated actors. Microsoft’s own security guidance and prior CISA analysis show that Exchange-related weaknesses often become popular because they can be exploited remotely and leveraged for deep access. Once mail systems are exposed, attackers can harvest credentials, inbox contents, calendar data, and internal trust relationships.
The Windows flaws are different but equally important. An out-of-bounds read can be used in chained exploitation or information disclosure scenarios, while link following bugs often appear mundane until they are used to bypass protections or manipulate file handling logic. These are the kinds of vulnerabilities that may look narrow on paper but become serious when paired with phishing, local privilege escalation, or other post-exploitation steps.

Exchange remains a persistent target​

Exchange Server has survived repeated waves of exploitation because it occupies a unique place in the enterprise stack. It is both core infrastructure and externally reachable, which gives attackers a lot of leverage if they discover a flaw. That combination has made it a recurring subject in CISA guidance and incident response reports.
Organizations still running on-premises Exchange should take this KEV inclusion as a signal to review not only patch status but also overall exposure. Internet-facing deployment, stale certificates, old authentication paths, and delayed update cycles all amplify risk. The operational reality is simple: if the server is reachable and unpatched, it is likely already being scanned.

Windows flaws and the “small bug, big impact” problem​

Windows vulnerabilities such as CVE-2023-36424 and CVE-2025-60710 illustrate a classic problem in enterprise security: modest-seeming flaws can become important when they touch core OS behavior. A link-following issue, for example, can be abused in contexts where symbolic links, junctions, or path handling affect security boundaries. That can create surprising abuse paths in systems that otherwise appear patched and compliant.
For defenders, this means patching Windows is necessary but not enough. Logging, least privilege, controlled use of administrative rights, and software restriction policies still matter because OS-level vulnerabilities often become more dangerous when paired with weak identity hygiene or poor endpoint hardening. The patch closes the hole, but the surrounding architecture determines whether the hole mattered in the first place.

Practical Microsoft priorities​

Microsoft-heavy environments should think in terms of tiers. Exchange and internet-facing endpoints deserve immediate attention, followed by desktop and server assets with active user interaction. Legacy VBA usage should also be audited, because older macro-enabled workflows can survive long after their original business purpose has faded.
Key actions include:

• Verifying patch levels across Exchange and Windows fleets.
• Reviewing whether any VBA-dependent applications still require the affected library behavior.
• Checking for internet exposure on systems that should be internal-only.
• Correlating KEV entries with asset criticality, not just software inventory.
• Validating compensating controls such as segmentation and restricted admin access.

---

Adobe Acrobat, Reader, and the Enduring Document Threat​

Adobe’s presence in the catalog is not a surprise, but it is still a warning. Adobe Acrobat and Reader remain frequent exploit targets because PDFs are trusted, routinely exchanged, and deeply embedded in business workflows. That makes them ideal for phishing campaigns and malvertising delivery chains, especially when attackers can combine social engineering with a memory corruption flaw.
The inclusion of CVE-2020-9715 is a useful reminder that document viewers stay exposed long after a flaw is first disclosed. Adobe’s own bulletin categorized this as a use-after-free vulnerability that could lead to arbitrary code execution, which is the kind of issue attackers like because it can be weaponized in user-driven workflows. The age of the CVE does not reduce its usefulness to an adversary if the software remains present on vulnerable systems.
CVE-2026-34621 adds a newer angle: prototype pollution. That class of flaw is often discussed in web applications and JavaScript ecosystems, but its appearance in a reader application underscores how supply-chain complexity and parser behavior can create surprising attack surfaces. Even when exploitation paths differ from older memory corruption bugs, the end result can still be compromise through a crafted document.

Why PDF exploitation stays attractive​

Attackers prefer delivery mechanisms that blend in, and PDFs are still among the most effective. Employees expect to open them, security tools often need to balance detection with usability, and many organizations allow document exchange with only modest inspection. That combination keeps Acrobat and Reader perpetually relevant to threat actors.
The practical lesson is that endpoint protection needs to assume documents can be hostile. Sandboxing, attachment filtering, content disarm and reconstruction, and user training are still necessary even when software is patched. Patching shrinks the risk; it does not eliminate the habit of attack.

The consumer and enterprise split​

For consumers, the risk is often opportunistic: a malicious PDF in email, chat, or a download site. For enterprises, the risk is broader because Acrobat and Reader often sit in workflows that involve contracts, invoices, claims, government forms, and scanned documentation. That means one compromised workstation can become a pathway into business processes that rely on trust in document content.
Organizations should pay particular attention to:

• High-volume shared workstations.
• Finance, legal, and procurement teams.
• Email gateways that allow PDF attachments.
• Systems with outdated Acrobat deployment channels.
• Users who routinely open documents from external partners.

Adobe’s broader security lesson​

Adobe products repeatedly appear in exploit lists because they combine ubiquity with rich parsing complexity. Every extra file format feature expands the potential attack surface, and every business workflow that relies on a viewer makes exploitation more attractive. That is why document applications remain one of the most persistent categories in vulnerability response.
In that sense, the KEV addition is less an isolated event than a recurring pattern. If Adobe vulnerabilities are still showing up in active exploitation lists years after release, defenders should assume their patch latency is being measured by adversaries. The only sensible response is to reduce that latency aggressively.

---

Fortinet and the Perimeter Problem​

The Fortinet SQL injection vulnerability, CVE-2026-21643, deserves attention because edge devices often become strategic footholds. When a firewall, VPN gateway, or security appliance is compromised, the attacker is not just breaching a server; they may be stepping into a trusted control plane that sees authentication traffic and internal routing behavior. That makes perimeter flaws disproportionately dangerous.
SQL injection remains one of the most reliable and preventable vulnerability classes. CISA has repeatedly emphasized that secure coding practices, parameterized queries, and separation of data and code can eliminate this category of issue in many applications. The fact that a SQL injection flaw still made the KEV Catalog is a reminder that old lessons continue to be relearned in newer product generations.
The challenge with security appliances is that patching them is often operationally harder than patching endpoints. They may be distributed across sites, tied to maintenance windows, or treated as too critical to reboot frequently. That creates an ideal environment for adversaries: a well-known flaw, a widely deployed product, and defenders who hesitate because the box sits on the critical path.

Why edge devices attract attackers​

Edge devices are attractive because they sit between trust zones. If an attacker gets administrative access to a VPN gateway or firewall, they can often observe or influence large portions of network traffic. That makes even a single exploit materially more valuable than a comparable flaw in a low-privilege internal application.
This is why perimeter vulnerabilities tend to trigger urgent patches, emergency change reviews, and in some cases temporary service restrictions. The cost of downtime is real, but the cost of compromise is worse. A firewall flaw is not just another bug; it is a breach of the gatekeeper.

Security appliance remediation priorities​

Teams managing Fortinet products should focus on:

• Confirming the exact models and firmware versions in use.
• Checking whether the vulnerable feature set is enabled.
• Reviewing external exposure on internet-facing portals.
• Monitoring logs for authentication anomalies and unusual administrative actions.
• Coordinating patching with outage planning and rollback options.

The key point is that remediation should happen with the assumption of active adversarial interest. Once CISA adds a Fortinet flaw to KEV, the clock is no longer theoretical. It becomes a test of how quickly an organization can change exposure into resilience.

---

What the New KEV List Says About Attack Trends​

Taken together, the seven vulnerabilities paint a picture of modern intrusion strategy. Attackers continue to favor remote initial access, document-based phishing, mail server compromise, and edge-device abuse. Those are the paths that offer the best return on effort because they can be scaled, automated, and chained into broader campaigns.
The mix also highlights a hard truth about software risk. Some vulnerabilities remain exploitable for years because organizations struggle with patch discipline, while others become attractive because they appear in products that are too difficult to replace. In both cases, the vulnerability lives on because the operational environment gives it a chance to matter.
CISA’s catalog is therefore more than a list of bugs. It is a living map of where defenders are still losing ground to known attack paths. If there is a strategic takeaway from this announcement, it is that exploitation trends often move slower than headlines, which means backlog management is still one of the biggest cybersecurity problems in the enterprise.

Why older CVEs still matter​

The inclusion of CVE-2012-1854 should be read as a warning, not an oddity. Legacy vulnerabilities survive because legacy code, legacy add-ins, and legacy workflows survive. If a business still depends on old VBA-enabled documents or older application integrations, the attacker may not need a new exploit at all.
This is one reason “digital transformation” does not always eliminate security debt. When organizations modernize selectively, they often retain the weakest operational assumptions from older systems while layering new controls on top. That leaves gaps that adversaries are happy to exploit.

The role of prioritization​

The KEV Catalog works because it provides a clearer sorting mechanism than a generic scanner report. Not every vulnerability in a report deserves emergency attention, but every actively exploited one deserves a rapid review. That is why many security teams now use KEV data to drive patch queues, board reporting, and exception approvals.
A practical prioritization model usually follows this order:

• Internet-facing assets with KEV-listed flaws.
• High-value internal systems such as mail and identity services.
• Shared endpoints used by privileged staff.
• Widely deployed software with known exploitation history.
• Lower-risk systems where compensating controls are strong.

That sequence is not perfect, but it is far better than patching in the order of vendor marketing noise or scanner severity alone. Operational reality should outrank theoretical severity.

---

How Organizations Should Respond​

The first reaction should be inventory validation. If a vulnerability is in KEV, the organization must know whether the affected software exists anywhere in its environment, including forgotten virtual machines, lab systems, and business-unit-managed servers. Unknown assets are often the real reason patches are missed.
The second reaction should be exposure reduction. If a system cannot be patched immediately, move it behind tighter network controls, restrict administrative access, and monitor it more aggressively. Compensating controls are not a substitute for patching, but they can buy time when maintenance windows are constrained.
The third reaction should be validation. After remediation, verify that the update actually applied and that the vulnerable feature is no longer present. Security teams too often stop at deployment status, only to discover that reboots were deferred or that a plugin, extension, or dependent component remains vulnerable.

A practical response workflow​

A disciplined response process should look something like this:

• Identify assets that match the affected CVEs.
• Determine whether they are internet-facing or privilege-bearing.
• Patch or isolate the highest-risk systems first.
• Monitor logs and detections for exploitation attempts.
• Confirm remediation and document any exceptions.

That workflow is basic, but it is effective because it aligns urgency with real attack exposure. The goal is not to make every vulnerability go away instantly. The goal is to make the attack path too expensive, too noisy, or too delayed to be worthwhile.

Enterprise vs. smaller organizations​

Large enterprises have the advantage of scale, but they also have more complexity and more exceptions. Smaller organizations may have fewer systems, but they often lack automation and may depend on a single generalist administrator who wears too many hats. In both cases, KEV lists help focus effort where it matters most.
For smaller teams, the best defense is usually ruthless prioritization. If a system is exposed to the internet and a KEV vulnerability exists, it should move to the top of the queue regardless of business inconvenience. Delayed patching is a hidden form of risk acceptance.

---

Strengths and Opportunities​

CISA’s KEV model continues to be one of the most practical tools in public-sector cybersecurity because it turns a huge, noisy vulnerability landscape into a smaller, actionable list. The new seven-entry update demonstrates that the program is still responsive to real-world exploitation patterns and still useful as a prioritization aid for both government and private-sector defenders. It also creates an opportunity for organizations to mature their patch programs around exposure, not just severity.

• Better prioritization by focusing on known exploitation rather than theoretical risk.
• Clearer remediation deadlines for federal agencies and a strong signal for everyone else.
• Improved executive reporting because KEV-backed action is easier to explain.
• More realistic patch queues that reflect actual attacker behavior.
• Stronger pressure on vendors to address recurring product classes like document parsing and edge-device flaws.
• Useful cross-team coordination between IT ops, security, and business owners.
• A living benchmark for whether an organization is keeping up with active threats.

Risks and Concerns​

The main concern is that KEV inclusions often arrive after exploitation has already been underway, which means organizations that rely on conventional patch cycles can still be behind the curve. Another risk is operational fatigue: if too many vulnerabilities are treated as urgent without proper context, teams may start to tune out the signal. The challenge is to treat the catalog as a precision tool, not a blunt instrument.

• Patch backlog risk in organizations with slow maintenance cycles.
• Legacy software exposure that survives because business processes depend on it.
• Edge-device concentration risk where one flaw can expose a large network segment.
• Phishing amplification when document-reader vulnerabilities are paired with social engineering.
• Incomplete asset visibility leading to missed vulnerable systems.
• Change-management friction that delays remediation on critical systems.
• Complacency after patching if validation and monitoring are not equally strong.

---

Looking Ahead​

The next few weeks will likely show whether this KEV batch triggers a broad remediation push or simply blends into the background noise of routine vulnerability news. The most mature organizations will use the list to drive immediate patch confirmation, exposure review, and detection tuning. Less mature organizations will probably wait until external scanning, vendor notices, or incident response activity forces the issue.
What to watch next:

• Whether Microsoft, Adobe, or Fortinet issue follow-on guidance or updated advisories.
• Whether threat intelligence vendors report new exploitation campaigns tied to these CVEs.
• Whether the KEV Catalog grows further with additional perimeter or document-related flaws.
• Whether federal and enterprise patch compliance improves in the next reporting cycle.
• Whether defenders begin treating older, “legacy” CVEs as first-class risks again.

The broader trend is unlikely to change: attackers will keep targeting the software that is widely deployed, hard to remove, and easy to reach. That means the organizations that win are the ones that can turn exploit intelligence into action fast enough to matter. CISA’s latest KEV update is less a headline than a benchmark, and the real test is whether defenders treat it that way.

---

Source: CISA CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA