CISA Known Exploited Vulnerabilities
KEV additions — April 2026
23 CVEs entered the KEV catalog in April 2026.
Added April 30, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-41940 | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | 9.8 | 28.4 % | May 3, 2026 |
Added April 28, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-1708 | ConnectWise ScreenConnect Path Traversal Vulnerability | 8.4 | 52.1 % | May 12, 2026 |
| CVE-2026-32202 | Windows Shell Spoofing Vulnerability | 4.3 | 7.2 % | May 12, 2026 |
Added April 24, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-57726 | SimpleHelp Missing Authorization Vulnerability | 9.9 | 0.3 % | May 8, 2026 |
| CVE-2024-57728 | SimpleHelp Path Traversal Vulnerability | 7.2 | 1.0 % | May 8, 2026 |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Path Traversal Vulnerability | 7.5 | 71.0 % | May 8, 2026 |
| CVE-2025-29635 | D-Link DIR-823X Command Injection Vulnerability | 8.8 | 1.6 % | May 8, 2026 |
Added April 23, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-39987 | Marimo Remote Code Execution Vulnerability | — | 2.7 % | May 7, 2026 |
Added April 22, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-33825 | Microsoft Defender Elevation of Privilege Vulnerability | 7.8 | 4.9 % | May 6, 2026 |
Added April 20, 20268
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-27351 | PaperCut NG/MF Improper Authentication Vulnerability | 7.5 | 47.9 % | May 4, 2026 |
| CVE-2024-27199 | JetBrains TeamCity Relative Path Traversal Vulnerability | 7.3 | 94.5 % | May 4, 2026 |
| CVE-2025-2749 | Kentico Xperience Path Traversal Vulnerability | 7.2 | 1.2 % | May 4, 2026 |
| CVE-2025-32975 | Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability | 10 | 46.5 % | May 4, 2026 |
| CVE-2025-48700 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | 6.1 | 18.8 % | April 23, 2026 |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability | 5.4 | 1.1 % | April 23, 2026 |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | 7.5 | 0.0 % | April 23, 2026 |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | 6.5 | 1.3 % | April 23, 2026 |
Added April 14, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-32201 | Microsoft SharePoint Server Spoofing Vulnerability | 6.5 | 6.9 % | April 28, 2026 |
Added April 13, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-9715 | Adobe Acrobat Use-After-Free Vulnerability | 7.8 | 56.2 % | April 27, 2026 |
| CVE-2025-60710 | Microsoft Windows Link Following Vulnerability | 7.8 | 0.2 % | April 27, 2026 |
| CVE-2026-21643 | SQL Injection Vulnerability in FortiClientEMS 7.4.4 Allows Unauthenticated Remote Code Execution | 9.8 | 62.5 % | April 16, 2026 |
Added April 8, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-1340 | Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile | 9.8 | 66.8 % | April 11, 2026 |
Added April 1, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-5281 | chromium-browser: Use after free in Dawn | — | 1.1 % | April 15, 2026 |