InfoSecBulletin Cybersecurity for mankind
Crooks are taking advantage of four Microsoft flaws – one fixed 14 years ago and another linked to ransomware – as reported by the top U.S. cyber defense agency, which on Monday told federal agencies they have two weeks to fix them.
The four security issues added to CISA’s Known Exploited Vulnerabilities (KEV) list on Monday are:
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529 is a security issue in Microsoft Exchange Server. It lets a logged-in attacker run code from far away. Microsoft announced and fixed this problem in February 2023. Last week, Microsoft’s security team said that a crime group called Storm-1175 is using this Exchange flaw along with 15 others. They are getting into organizations to steal data and use Medusa ransomware to extort money.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft released a security fix for this issue in July 2012. They followed with a full update in November 2012. Back then, Redmond noted that they knew of limited attacks trying to use the weakness. This shows that a flaw first used almost 14 years ago is still seen in attacks today.
CISA lists ransomware use for all four as “unknown,” although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
CISA also added two Adobe flaws on Monday. One was a use-after-free issue in Acrobat called CVE-2020-9715. The other was a prototype pollution flaw, CVE-2026-34621, which affected Acrobat and Reader. This flaw had been used in attacks for months, and Adobe finally provided a fix over the weekend. ®
