CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA added 13 vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog in early April 2026 (per multiple alerts), based on evidence of active exploitation. The additions affect multiple vendors and products (Microsoft, Adobe, Fortinet, Ivanti, Citrix, F5, Google, TrueConf, etc.) and include high-impact issues such as remote code execution, SQL injection, deserialization of untrusted data, use-after-free, prototype pollution, out-of-bounds reads, code-injection, and improper access control. CISA reiterates BOD 22-01 remediation requirements and urges timely patching and mitigation.