InfoSecBulletin Cybersecurity for mankind
Crooks are taking advantage of four Microsoft flaws – one fixed 14 years ago and another linked to ransomware – as reported by the top U.S. cyber defense agency, which on Monday told federal agencies they have two weeks to fix them.
The four security issues added to CISA’s Known Exploited Vulnerabilities (KEV) list on Monday are:
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529 is a security issue in Microsoft Exchange Server. It lets a logged-in attacker run code from far away. Microsoft announced and fixed this problem in February 2023. Last week, Microsoft’s security team said that a crime group called Storm-1175 is using this Exchange flaw along with 15 others. They are getting into organizations to steal data and use Medusa ransomware to extort money.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft released a security fix for this issue in July 2012. They followed with a full update in November 2012. Back then, Redmond noted that they knew of limited attacks trying to use the weakness. This shows that a flaw first used almost 14 years ago is still seen in attacks today.
CISA lists ransomware use for all four as “unknown,” although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
CISA also added two Adobe flaws on Monday. One was a use-after-free issue in Acrobat called CVE-2020-9715. The other was a prototype pollution flaw, CVE-2026-34621, which affected Acrobat and Reader. This flaw had been used in attacks for months, and Adobe finally provided a fix over the weekend. ®
