Flaws added in April 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in April 2026. For the newest, see Exploited flaws.
In April 2026, CISA added 31 flaws to its list of vulnerabilities being used in attacks, 8 of them in things people have at home; 9 have been used by ransomware gangs. Most came from Microsoft (8), Cisco (3) and SimpleHelp (2).[1]
About half let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in April 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-41940† Used in ransomwareAt work |
WebPros cPanel & WHM and WP2 (WordPress Squared). Attackers can get into WebPros cPanel & WHM and WP2 (WordPress Squared) without a valid password. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-32202At home |
Microsoft Windows. Attackers can make something fake look genuine in Microsoft Windows. | At home |
CVE-2024-1708† Used in ransomwareAt work |
ConnectWise ScreenConnect. Attackers can read files on ConnectWise ScreenConnect that should be out of reach. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-29635At home |
D-Link DIR-823X. Attackers can run commands on D-Link DIR-823X. | At home |
CVE-2024-7399At work |
Samsung MagicINFO 9 Server. Attackers can reach parts of Samsung MagicINFO 9 Server that should be locked to them. | At work |
CVE-2024-57728† Used in ransomwareAt work |
SimpleHelp. Attackers can run their own code on SimpleHelp. | At work |
CVE-2024-57726† Used in ransomwareAt work |
SimpleHelp. Someone who already has a foothold can use SimpleHelp to take full control of the machine. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-39987At work |
Marimo. Attackers can run their own code on Marimo from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-33825† Used in ransomwareAt home |
Microsoft Defender. Someone who already has a foothold can use Microsoft Defender to take full control of the machine. | At home |
8 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20133At work |
Cisco Catalyst SD-WAN Manager. Attackers can read information from Cisco Catalyst SD-WAN Manager that should be private from anywhere, without logging in. | At work |
CVE-2026-20128At work |
Cisco Catalyst SD-WAN Manager. Attackers can read information from Cisco Catalyst SD-WAN Manager that should be private from anywhere, without logging in. | At work |
CVE-2026-20122At work |
Cisco Catalyst SD-WAN Manger. Attackers can reach parts of Cisco Catalyst SD-WAN Manger that should be locked to them. | At work |
CVE-2025-48700At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can run code in the browser of someone using Synacor Zimbra Collaboration Suite (ZCS) and act as them. | At work |
CVE-2025-32975At work |
Quest KACE Systems Management Appliance (SMA). Attackers can get into Quest KACE Systems Management Appliance (SMA) without a valid password. | At work |
CVE-2025-2749At work |
Kentico Xperience. Someone who already has a way in can use Kentico Xperience to run their own code. | At work |
CVE-2024-27199† Used in ransomwareAt work |
JetBrains TeamCity. Attackers can read files on JetBrains TeamCity that should be out of reach. | At work |
CVE-2023-27351† Used in ransomwareAt work |
PaperCut NG/MF. Attackers can get into PaperCut NG/MF without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-34197At work |
Apache ActiveMQ. Someone who already has a way in can use Apache ActiveMQ to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-32201At work |
Microsoft SharePoint Server. Attackers can make something fake look genuine in Microsoft SharePoint Server. | At work |
CVE-2009-0238At home |
Microsoft Office. Opening a booby-trapped file can let an attacker run their own code through Microsoft Office. | At home |
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-34621At home |
Adobe Acrobat and Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Acrobat and Reader. | At home |
CVE-2026-21643At work |
Fortinet FortiClient EMS. Attackers can read or change the database behind Fortinet FortiClient EMS from anywhere, without logging in. | At work |
CVE-2025-60710† Used in ransomwareAt home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2023-36424At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2023-21529† Used in ransomwareAt work |
Microsoft Exchange Server. Someone who already has a way in can use Microsoft Exchange Server to run their own code. | At work |
CVE-2020-9715At home |
Adobe Acrobat. Attackers can run their own code on Adobe Acrobat. | At home |
CVE-2012-1854At work |
Microsoft Visual Basic for Applications (VBA). Someone who already has a way in can use Microsoft Visual Basic for Applications (VBA) to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-1340At work |
Ivanti Endpoint Manager Mobile (EPMM). Attackers can run their own code on Ivanti Endpoint Manager Mobile (EPMM) from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-35616At work |
Fortinet FortiClient EMS. Attackers can reach parts of Fortinet FortiClient EMS that should be locked to them from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-3502At work |
TrueConf Client. Attackers can run their own code on TrueConf Client. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-5281At work |
Google Dawn. A booby-trapped web page can run an attacker's code through Google Dawn. | At work |
Companies
The flaws were in 19 companies’ products; the most were in Microsoft’s (8).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 8 | 3 |
| Cisco | 3 | – |
| Adobe | 2 | – |
| Fortinet | 2 | – |
| SimpleHelp | 2 | 2 |
| Apache | 1 | – |
| ConnectWise | 1 | 1 |
| D-Link | 1 | – |
| 1 | – | |
| Ivanti | 1 | – |
| JetBrains | 1 | 1 |
| Kentico | 1 | – |
| Marimo | 1 | – |
| PaperCut | 1 | 1 |
| Quest | 1 | – |
| 4 others | 4 |
Other months
Every month since CISA started the list; April 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.