Zero-day report: April 2026
CISA added 31 exploited vulnerabilities to its catalog in April 2026, 5 more than March (26). 6 were zero-days, listed within a week of going public. 9 are known to be used by ransomware. The most-hit vendor was Microsoft, with 8.
By technology
Most-hit vendors
Every flaw added in April 2026
- WebPros · cPanel & WHM and WP2 (WordPress Squared)WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
- ConnectWise · ScreenConnectConnectWise ScreenConnect Path Traversal Vulnerability
- Microsoft · WindowsMicrosoft Windows Protection Mechanism Failure Vulnerability
- SimpleHelp · SimpleHelpSimpleHelp Missing Authorization Vulnerability
- SimpleHelp · SimpleHelpSimpleHelp Path Traversal Vulnerability
- Samsung · MagicINFO 9 ServerSamsung MagicINFO 9 Server Path Traversal Vulnerability
- D-Link · DIR-823XD-Link DIR-823X Command Injection Vulnerability
- Marimo · MarimoMarimo Remote Code Execution Vulnerability
- Microsoft · DefenderMicrosoft Defender Insufficient Granularity of Access Control Vulnerability
- PaperCut · NG/MFPaperCut NG/MF Improper Authentication Vulnerability
- JetBrains · TeamCityJetBrains TeamCity Relative Path Traversal Vulnerability
- Kentico · Kentico XperienceKentico Xperience Path Traversal Vulnerability
- Quest · KACE Systems Management Appliance (SMA)Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- Cisco · Catalyst SD-WAN MangerCisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
- Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
- Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
- Apache · ActiveMQApache ActiveMQ Improper Input Validation Vulnerability
- Microsoft · OfficeMicrosoft Office Remote Code Execution
- Microsoft · SharePoint ServerMicrosoft SharePoint Server Improper Input Validation Vulnerability
- Microsoft · Visual Basic for Applications (VBA)Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Adobe · AcrobatAdobe Acrobat Use-After-Free Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Microsoft · WindowsMicrosoft Windows Out-of-Bounds Read Vulnerability
- Microsoft · WindowsMicrosoft Windows Link Following Vulnerability
- Fortinet · FortiClient EMSFortinet FortiClient EMS SQL Injection Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Prototype Pollution Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Fortinet · FortiClient EMSFortinet FortiClient EMS Improper Access Control Vulnerability
- TrueConf · ClientTrueConf Client Download of Code Without Integrity Check Vulnerability
- Google · DawnGoogle Dawn Use-After-Free Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.