ACCORDING to CISA, on 14 April 2026 seven vulnerabilities were added to its Known Exploited Vulnerabilities (KEV) catalog, including two Windows flaws. The first Windows defect is CVE-2023-36424, described as a common log file driver issue that could lead to privilege escalation, with patches released by Microsoft in November 2023 and PoC code published the following month.
The second Windows flaw is CVE-2025-60710, a link-following vulnerability in the host process for Windows Tasks that could be exploited for privilege escalation, with patches available since November 2025 and PoC code released soon after. The KEV list also includes CVE-2020-9715, a use-after-free bug in Adobe Acrobat and Reader, patched in August 2020, with PoC code publicly available for years.
CISA also added CVE-2023-21529 (an Exchange weakness) and newer issues in Adobe Acrobat and Fortinet FortiClient EMS to the KEV list, all described as allowing remote code execution or arbitrary code execution. Federal agencies are urged to apply fixes within two weeks, except for the Fortinet bug, which should be patched by 16 April.