Overall Risk Posture: Elevated

The week ending April 12 reinforced a clear 2026 pattern: the highest-consequence activity is still clustering around systems that sit close to trust, administration, and operational control. CISA added Ivanti Endpoint Manager Mobile CVE-2026-1340 to the Known Exploited Vulnerabilities catalog on April 8, just days after Fortinet’s FortiClient EMS CVE-2026-35616 was added on April 6. At the same time, U.S. and allied agencies warned about two broader infrastructure-level risks: Iranian-affiliated actors exploiting internet-connected PLCs, and APT28 abusing vulnerable routers for DNS hijacking and credential theft.

For defenders, the lesson is not simply that exploitation is active. It is that compromise keeps landing where downstream reach is largest: mobile device management, endpoint administration, industrial control, and the edge devices that quietly shape authentication and traffic flow. The blast radius is greatest where trusted infrastructure sits between users, systems, and policy.

• Ivanti EPMM moved back into immediate-priority territory
  This week’s biggest omission would have been Ivanti. On April 8, CISA added CVE-2026-1340 in Ivanti Endpoint Manager Mobile (EPMM) to the KEV catalog. Canada’s Cyber Centre notes that Ivanti has stated both CVE-2026-1281 and CVE-2026-1340 have been exploited in the wild. That matters because EPMM is not just another exposed service. It is a mobile management platform with administrative authority over enrolled devices, policy, and enterprise mobility workflows. When exploitation reaches that layer, the risk extends well beyond a single server.
• Fortinet FortiClient EMS remained a control-plane patch-now issue
  Fortinet’s CVE-2026-35616 remained one of the clearest immediate remediation priorities of the week. The Canadian Centre for Cyber Security describes it as an improper access control flaw in FortiClient EMS 7.4.5 through 7.4.6 that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. The vulnerability was added to CISA’s KEV catalog on April 6. Because EMS is a centralized security management layer for endpoint agents, ZTNA tags, and vulnerability scanning, the risk is not only compromise of one management server, but potential downstream influence over the security fabric itself.
• Internet-exposed PLCs again showed how quickly OT exposure becomes operational risk
  On April 7, CISA published an advisory warning that Iranian-affiliated cyber actors are exploiting programmable logic controllers across U.S. critical infrastructure. The advisory says the activity has led to PLC disruptions through malicious interactions with project files, and specifically points defenders toward internet-exposed OT assets as a persistent weakness. This is important because it shifts the story from theoretical OT risk to active disruptive behavior against reachable industrial systems.
• APT28’s router activity showed that infrastructure compromise can become identity compromise
  The UK NCSC warned on April 7 that APT28 has been exploiting vulnerable routers to overwrite DHCP and DNS settings, redirecting traffic through attacker-controlled DNS servers. The resulting adversary-in-the-middle operations are designed to harvest passwords, OAuth tokens, and other credentials tied to web and email services. The FBI and international partners echoed the warning, noting that the activity has affected routers globally and has targeted military, government, and critical infrastructure information. This is a strong reminder that identity risk does not always begin inside the identity platform. Sometimes it begins in the network devices users never think about.

• Administrative platforms are still among the most dangerous failure points
  Ivanti EPMM and FortiClient EMS are different products, but they belong to the same broader class of risk: management systems with trusted administrative reach. When actively exploited vulnerabilities hit those platforms, the concern is not just initial access. It is policy manipulation, device influence, visibility degradation, and broader operational control. That is why these issues deserve more attention than raw CVSS scores alone would suggest.
• Edge infrastructure keeps collapsing into the identity security conversation
  The APT28 router campaign matters beyond networking teams because DNS hijacking can place attackers in the path before many higher-level controls have a chance to matter. Credentials, session material, and trust in web workflows are all at risk when routers or related edge devices silently alter resolution paths. Defenders should keep treating edge-device integrity as part of the identity security boundary, not as a separate operational concern.
• Browser exploitation remains relevant, even when the week’s headline shifts elsewhere
  Google’s March 31 desktop Chrome update fixed CVE-2026-5281, and Google said an exploit exists in the wild. It was not the main story this week, but it remains part of the same pattern: trusted client platforms still act as high-value paths into enterprise workflows, especially where authentication and session-heavy SaaS access are involved.

• Prioritize Ivanti EPMM and FortiClient EMS as high-consequence management-plane issues, not routine patch items. Where either platform is present, verify exposure, apply vendor guidance, and look for signs of unauthorized access or configuration manipulation.
• Review industrial environments for internet-exposed PLCs and reduce direct exposure wherever possible. If controllers are reachable from the public internet, the risk is no longer hypothetical.
• Audit routers and other edge devices for unauthorized DNS or DHCP changes, weak remote management exposure, and outdated firmware. The router story this week is not just about espionage infrastructure. It is about how quietly infrastructure compromise can enable credential theft and broader follow-on access.
• Continue pushing browser updates quickly, especially where delayed restarts or lagging enterprise deployment rings create patch gaps after in-the-wild exploitation is disclosed.
• Reassess which systems deserve “critical” remediation treatment. In practice, that list should include device management platforms, endpoint control planes, edge networking gear, and internet-reachable OT assets.

The week ending April 12 did not revolve around one single mega-story. Instead, it reinforced a more important operational truth: trusted intermediaries are still where the most dangerous weakness accumulates. Ivanti EPMM and FortiClient EMS showed the continued risk of exposed administrative platforms. The PLC advisory showed that OT exposure still converts directly into disruptive potential. The APT28 router campaign showed that the edge can become the first stage of credential theft and broader compromise.

This week’s threat picture was not defined by volume. It was defined by where exploitation landed. When attackers gain leverage over management systems, edge infrastructure, or internet-exposed industrial assets, the downstream risk rises fast. Patch the trusted control layers first, reduce avoidable exposure, and treat infrastructure that mediates access, policy, or operations as part of the core security boundary.