CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
2026-04-21T07:24:11Z•2b4da62fea8500604e9f90cae77aacf75a54f07ae0681ee6132a939a35fc2540
CISA KEVOT targetingactive exploitationapache-activemqbotnetciscomalwaremicrosoftn8nnginx-uiobsidian-pluginpatchesremote code executionsglangsupply chainvulnerability managementzero-day
What happened
The Hacker News roundup highlights a surge of high-impact, actively exploited vulnerabilities and related incidents: CISA added eight exploited flaws to its KEV (including a PaperCut issue), while critical RCE and authentication-bypass bugs were disclosed in SGLang (CVE-2026-5760), nginx-ui (CVE-2026-33032), and Apache ActiveMQ (CVE-2026-34197). Cisco released patches for multiple critical identity/Webex flaws (e.g., CVE-2026-20184), Microsoft pushed fixes for a record set of issues including an actively exploited SharePoint zero-day, and a Mirai variant (Nexcorium) is abusing CVE-2024-3721. O
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 2b4da62fea8500604e9f90cae77aacf75a54f07ae0681ee6132a939a35fc2540
- Enrichment time
- 2026-04-21T07:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.