InfoSecBulletin Cybersecurity for mankind
Crooks are taking advantage of four Microsoft flaws – one fixed 14 years ago and another linked to ransomware – as reported by the top U.S. cyber defense agency, which on Monday told federal agencies they have two weeks to fix them.
The four security issues added to CISA’s Known Exploited Vulnerabilities (KEV) list on Monday are:
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529 is a security issue in Microsoft Exchange Server. It lets a logged-in attacker run code from far away. Microsoft announced and fixed this problem in February 2023. Last week, Microsoft’s security team said that a crime group called Storm-1175 is using this Exchange flaw along with 15 others. They are getting into organizations to steal data and use Medusa ransomware to extort money.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft released a security fix for this issue in July 2012. They followed with a full update in November 2012. Back then, Redmond noted that they knew of limited attacks trying to use the weakness. This shows that a flaw first used almost 14 years ago is still seen in attacks today.
CISA lists ransomware use for all four as “unknown,” although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
CISA also added two Adobe flaws on Monday. One was a use-after-free issue in Acrobat called CVE-2020-9715. The other was a prototype pollution flaw, CVE-2026-34621, which affected Acrobat and Reader. This flaw had been used in attacks for months, and Adobe finally provided a fix over the weekend. ®
