This Week in Threats: Apr 07–Apr 21, 2026

Weekly Threat Summary

11 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 9.8.

This week includes 2 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2026-21643 — Fortinet SQL Injection Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-04-13
• Description: Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-1340 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-04-08
• Description: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-34197 — Apache ActiveMQ Improper Input Validation Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-04-16
• Description: Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2009-0238 — Microsoft Office Remote Code Execution

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-04-14
• Description: Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2023-21529 — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-04-13
• Description: Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-34621 — Adobe Acrobat and Reader Prototype Pollution Vulnerability

• CVSS Score: 8.6 (HIGH)
• Date Added: 2026-04-13
• Description: Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2020-9715 — Adobe Acrobat Use-After-Free Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-04-13
• Description: Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2023-36424 — Microsoft Windows Out-of-Bounds Read Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-04-13
• Description: Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-60710 — Microsoft Windows Link Following Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-04-13
• Description: Microsoft Windows contains a link following vulnerability that allows for privilege escalation
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2012-1854 — Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-04-13
• Description: Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-32201 — Microsoft SharePoint Server Improper Input Validation Vulnerability

• CVSS Score: 6.5 (MEDIUM)
• Date Added: 2026-04-14
• Description: Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2026-21643 → D2 Threats & Vulnerabilities
• CVE-2026-1340 → D2 Threats & Vulnerabilities, D4 Security Operations
• CVE-2026-34197 → D2 Threats & Vulnerabilities
• CVE-2009-0238 → D2 Threats & Vulnerabilities
• CVE-2023-21529 → D2 Threats & Vulnerabilities
• CVE-2023-36424 → D4 Security Operations
• CVE-2025-60710 → D2 Threats & Vulnerabilities

ISC2 CISSP

• CVE-2026-21643 → D6 Security Assessment
• CVE-2026-1340 → D6 Security Assessment
• CVE-2026-34197 → D6 Security Assessment
• CVE-2009-0238 → D6 Security Assessment
• CVE-2023-21529 → D6 Security Assessment
• CVE-2026-34621 → D6 Security Assessment
• CVE-2020-9715 → D6 Security Assessment
• CVE-2023-36424 → D6 Security Assessment
• CVE-2025-60710 → D6 Security Assessment
• CVE-2012-1854 → D6 Security Assessment, D8 Software Development
• CVE-2026-32201 → D6 Security Assessment

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.