InfoSecBulletin Cybersecurity for mankind
Crooks are taking advantage of four Microsoft flaws – one fixed 14 years ago and another linked to ransomware – as reported by the top U.S. cyber defense agency, which on Monday told federal agencies they have two weeks to fix them.
The four security issues added to CISA’s Known Exploited Vulnerabilities (KEV) list on Monday are:
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529 is a security issue in Microsoft Exchange Server. It lets a logged-in attacker run code from far away. Microsoft announced and fixed this problem in February 2023. Last week, Microsoft’s security team said that a crime group called Storm-1175 is using this Exchange flaw along with 15 others. They are getting into organizations to steal data and use Medusa ransomware to extort money.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft released a security fix for this issue in July 2012. They followed with a full update in November 2012. Back then, Redmond noted that they knew of limited attacks trying to use the weakness. This shows that a flaw first used almost 14 years ago is still seen in attacks today.
CISA lists ransomware use for all four as “unknown,” although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
CISA also added two Adobe flaws on Monday. One was a use-after-free issue in Acrobat called CVE-2020-9715. The other was a prototype pollution flaw, CVE-2026-34621, which affected Acrobat and Reader. This flaw had been used in attacks for months, and Adobe finally provided a fix over the weekend. ®
