Published: April 14, 2026
CISA KEV Update: On April 13, CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities catalog. On paper, the list looks strange: a 2012 Microsoft bug, a 2020 Adobe flaw, two 2023 issues, a 2025 Windows vulnerability, and two 2026 vulnerabilities affecting Fortinet and Adobe. But that odd mix is exactly what makes this update worth attention. It is not a story about one vendor or one product family breaking down. It is a story about the same old enterprise problem: attackers continue to find value anywhere organizations leave reachable, unpatched, or weakly managed systems behind.
CISA’s April 13 update added the following seven CVEs to the catalog:
CISA adds vulnerabilities to KEV when there is evidence of active exploitation. That means these entries are not just theoretical patching tasks. They are current exposure questions for defenders.
This CISA KEV Update is unusual because it brings together vulnerabilities from 2012, 2020, 2023, 2025, and 2026 in a single active exploitation signal.
The most revealing part of today’s KEV update is not just which products appear in the list. It is the time span. A vulnerability first assigned in 2012 now sits beside flaws disclosed in 2026, with 2020, 2023, and 2025 issues in between. That should push defenders away from a narrow fixation on novelty. The active exploitation problem is not just about fresh zero-days. It is also about legacy software, patch debt, overlooked infrastructure, and old weaknesses that remain present in real environments.
Attackers do not organize campaigns around the age of a CVE. They organize them around opportunity. If an older flaw still exists somewhere useful in the enterprise, it can still produce results.
One of the most strategically important entries in today’s update is CVE-2023-21529, a Microsoft Exchange Server deserialization of untrusted data vulnerability. Exchange has long remained one of the most operationally sensitive parts of on-prem enterprise infrastructure because it combines internet exposure, privileged internal positioning, and access to communications data. When an Exchange issue lands in KEV, defenders should read that as more than another Microsoft patching task. It is a reminder that messaging infrastructure remains a high-value target whenever it is exposed or insufficiently maintained.
The Fortinet entry is also difficult to ignore. CVE-2026-21643 affects FortiClient EMS and is described by Fortinet as an SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands through crafted HTTP requests. Fortinet’s advisory states that the issue has been observed exploited in the wild.
That matters because this is exactly the category defenders have learned to treat seriously: management software that is trusted internally, often highly connected, and sometimes insufficiently protected from external access. Once again, the lesson is not limited to one vendor. Administrative and security management surfaces remain attractive because they often provide leverage far beyond the system they directly manage.
Adobe appears twice in this KEV update: once through the older CVE-2020-9715 and again through CVE-2026-34621. For the newer issue, Adobe says its APSB26-43 bulletin addresses a critical Acrobat and Reader vulnerability and that the company is aware of exploitation in the wild. Exploitation requires user interaction, meaning the victim must open a malicious file.
That does not make the issue minor. It makes it familiar. Document-based compromise remains durable because PDF workflows and file sharing are still embedded in daily business operations. User-facing software continues to matter because trusted files remain one of the easiest ways to cross from outside the organization into inside workflows.
The Windows entries in today’s KEV update add another important point. Not every exploited vulnerability is about initial access. Some support local exploitation, privilege escalation, or post-compromise activity. Defenders should think about these vulnerabilities as part of intrusion chains rather than as isolated bugs. One flaw may help establish access. Another may help deepen control. Another may help persistence or lateral movement.
That is why a mixed KEV list like this deserves attention. Attackers do not need every bug to be dramatic. They need each one to be useful somewhere in the attack path.
What ties this list together is not vendor, age, or product type. It is enterprise exposure. Today’s additions span legacy Office-related components, user-facing document software, Exchange infrastructure, Windows internals, and enterprise management tooling. These are different layers of the environment, but each can sit somewhere meaningful in real attack paths.
The right takeaway is not simply “patch the newest bugs first.” It is closer to this: patch what is actively exploited, isolate what is exposed, and stop assuming that old software debt has become irrelevant. A 2012 bug showing up in a 2026 KEV update is not just a curiosity. It is a warning.
CISA’s latest KEV update is not really a story about a 2012 bug and two 2026 bugs. It is a story about how attackers keep winning on the same enterprise conditions: patch debt, exposed management surfaces, trusted document workflows, and infrastructure that remains too important to fail but too hard to modernize quickly. The years attached to the CVEs may be different. The operational problem is not.
If you find ByteVanguard useful, you can support the site and help keep the analysis independent.
Support the analysis