CISA KEV · April 2026
In April 2026, CISA added 31 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 26 in March 2026. 9 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (8), Cisco (3), SimpleHelp (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 30 Apr 2026 | CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityRANSOMWAREWebPros · cPanel & WHM and WP2 (WordPress Squared) | |
| 28 Apr 2026 | CVE-2026-32202 | Microsoft Windows Protection Mechanism Failure VulnerabilityMicrosoft · Windows | |
| 28 Apr 2026 | CVE-2024-1708 | ConnectWise ScreenConnect Path Traversal VulnerabilityRANSOMWAREConnectWise · ScreenConnect | |
| 24 Apr 2026 | CVE-2025-29635 | D-Link DIR-823X Command Injection VulnerabilityD-Link · DIR-823X | |
| 24 Apr 2026 | CVE-2024-7399 | Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung · MagicINFO 9 Server | |
| 24 Apr 2026 | CVE-2024-57728 | SimpleHelp Path Traversal VulnerabilityRANSOMWARESimpleHelp · SimpleHelp | |
| 24 Apr 2026 | CVE-2024-57726 | SimpleHelp Missing Authorization VulnerabilityRANSOMWARESimpleHelp · SimpleHelp | |
| 23 Apr 2026 | CVE-2026-39987 | Marimo Remote Code Execution VulnerabilityMarimo · Marimo | |
| 22 Apr 2026 | CVE-2026-33825 | Microsoft Defender Insufficient Granularity of Access Control VulnerabilityRANSOMWAREMicrosoft · Defender | |
| 20 Apr 2026 | CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCisco · Catalyst SD-WAN Manager | |
| 20 Apr 2026 | CVE-2026-20128 | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format VulnerabilityCisco · Catalyst SD-WAN Manager | |
| 20 Apr 2026 | CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCisco · Catalyst SD-WAN Manger | |
| 20 Apr 2026 | CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS) | |
| 20 Apr 2026 | CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityQuest · KACE Systems Management Appliance (SMA) | |
| 20 Apr 2026 | CVE-2025-2749 | Kentico Xperience Path Traversal VulnerabilityKentico · Kentico Xperience | |
| 20 Apr 2026 | CVE-2024-27199 | JetBrains TeamCity Relative Path Traversal VulnerabilityRANSOMWAREJetBrains · TeamCity | |
| 20 Apr 2026 | CVE-2023-27351 | PaperCut NG/MF Improper Authentication VulnerabilityRANSOMWAREPaperCut · NG/MF | |
| 16 Apr 2026 | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation VulnerabilityApache · ActiveMQ | |
| 14 Apr 2026 | CVE-2026-32201 | Microsoft SharePoint Server Improper Input Validation VulnerabilityMicrosoft · SharePoint Server | |
| 14 Apr 2026 | CVE-2009-0238 | Microsoft Office Remote Code ExecutionMicrosoft · Office | |
| 13 Apr 2026 | CVE-2026-34621 | Adobe Acrobat and Reader Prototype Pollution VulnerabilityAdobe · Acrobat and Reader | |
| 13 Apr 2026 | CVE-2026-21643 | Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet · FortiClient EMS | |
| 13 Apr 2026 | CVE-2025-60710 | Microsoft Windows Link Following VulnerabilityRANSOMWAREMicrosoft · Windows | |
| 13 Apr 2026 | CVE-2023-36424 | Microsoft Windows Out-of-Bounds Read VulnerabilityMicrosoft · Windows | |
| 13 Apr 2026 | CVE-2023-21529 | Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityRANSOMWAREMicrosoft · Exchange Server | |
| 13 Apr 2026 | CVE-2020-9715 | Adobe Acrobat Use-After-Free VulnerabilityAdobe · Acrobat | |
| 13 Apr 2026 | CVE-2012-1854 | Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityMicrosoft · Visual Basic for Applications (VBA) | |
| 8 Apr 2026 | CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityIvanti · Endpoint Manager Mobile (EPMM) | |
| 6 Apr 2026 | CVE-2026-35616 | Fortinet FortiClient EMS Improper Access Control VulnerabilityFortinet · FortiClient EMS | |
| 2 Apr 2026 | CVE-2026-3502 | TrueConf Client Download of Code Without Integrity Check VulnerabilityTrueConf · Client | |
| 1 Apr 2026 | CVE-2026-5281 | Google Dawn Use-After-Free VulnerabilityGoogle · Dawn |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
31 vulnerabilities. In March 2026 it added 26.
Microsoft, with 8 entries. Next were Cisco (3), SimpleHelp (2), Adobe (2).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →