InfoSecBulletin Cybersecurity for mankind
Crooks are taking advantage of four Microsoft flaws – one fixed 14 years ago and another linked to ransomware – as reported by the top U.S. cyber defense agency, which on Monday told federal agencies they have two weeks to fix them.
The four security issues added to CISA’s Known Exploited Vulnerabilities (KEV) list on Monday are:
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529 is a security issue in Microsoft Exchange Server. It lets a logged-in attacker run code from far away. Microsoft announced and fixed this problem in February 2023. Last week, Microsoft’s security team said that a crime group called Storm-1175 is using this Exchange flaw along with 15 others. They are getting into organizations to steal data and use Medusa ransomware to extort money.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft released a security fix for this issue in July 2012. They followed with a full update in November 2012. Back then, Redmond noted that they knew of limited attacks trying to use the weakness. This shows that a flaw first used almost 14 years ago is still seen in attacks today.
CISA lists ransomware use for all four as “unknown,” although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
CISA also added two Adobe flaws on Monday. One was a use-after-free issue in Acrobat called CVE-2020-9715. The other was a prototype pollution flaw, CVE-2026-34621, which affected Acrobat and Reader. This flaw had been used in attacks for months, and Adobe finally provided a fix over the weekend. ®
