This Week in Threats: Mar 24–Apr 07, 2026

Weekly Threat Summary

6 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 9.9.

This week includes 2 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2025-68613 — n8n Improper Control of Dynamically-Managed Code Resources Vulnerability

• CVSS Score: 9.9 (CRITICAL)
• Date Added: 2026-03-11
• Description: n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-26399 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-03-09
• Description: SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-3909 — Google Skia Out-of-Bounds Write Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-03-13
• Description: Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-3910 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-03-13
• Description: Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-1603 — Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

• CVSS Score: 8.6 (HIGH)
• Date Added: 2026-03-09
• Description: Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2021-22054 — Omnissa Workspace ONE Server-Side Request Forgery

• CVSS Score: 7.5 (HIGH)
• Date Added: 2026-03-09
• Description: Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF)...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2025-68613 → D2 Threats & Vulnerabilities
• CVE-2025-26399 → D2 Threats & Vulnerabilities, D3 Security Architecture
• CVE-2026-1603 → D2 Threats & Vulnerabilities, D4 Security Operations

ISC2 CISSP

• CVE-2025-68613 → D6 Security Assessment
• CVE-2025-26399 → D6 Security Assessment
• CVE-2026-3909 → D6 Security Assessment
• CVE-2026-3910 → D6 Security Assessment
• CVE-2026-1603 → D5 IAM, D6 Security Assessment

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.