THE INFRASTRUCTURE DEFENDER

Cyber Threat Intelligence Summary

April 27, 2026 | Auth ID: one-IMPRIMIS

Source: Imprimis, Inc. | CyberDeck Blog

Reporting Period: April 27, 2026 – May 1, 2026

• Client: Standard Managed Profile 
• Cadence: Weekly

1. Executive Summary

CISA added 13 vulnerabilities to the KEV catalog this week across Cisco, Microsoft, Samsung, SimpleHelp, and D-Link platforms, with an Emergency Directive requiring federal agencies to hard-reset all Cisco devices by April 30. Microsoft’s April Patch Tuesday zero-day in Microsoft Defender (CVE-2026-33825) was confirmed as actively exploited and added to KEV on April 22. ADT confirmed a ShinyHunters breach affecting 5.5 million records, and Apple patched a forensic artifact vulnerability (CVE-2026-28950) that allowed extraction of deleted Signal message previews from iOS devices.

2. Critical Events

[CRITICAL]  Cisco Catalyst SD-WAN Manager — Three CVEs Confirmed Exploited, Emergency Hard-Reset Directive

Date: 2026-04-20 (KEV); directive updated 2026-04-23

CVE: CVE-2026-20122, CVE-2026-20128, CVE-2026-20133

Source: CISA KEV April 20 | BleepingComputer | Help Net Security

Three vulnerabilities in Cisco Catalyst SD-WAN Manager (formerly vManage) are confirmed actively exploited in a chained attack pattern. CVE-2026-20133 allows unauthenticated remote access to sensitive information; CVE-2026-20122 enables authenticated arbitrary file overwrite; and CVE-2026-20128 permits privilege escalation to Data Collection Agent user level. The three-stage chain allows an unauthenticated attacker to progress from reconnaissance to full administrative control. CISA Emergency Directive 25-03 (updated April 23) requires federal agencies to perform a hard reset of all Cisco devices by April 30, 2026.

[CRITICAL] Microsoft Defender CVE-2026-33825 — Elevation of Privilege to SYSTEM, Actively Exploited

Date: 2026-04-14 (Patch Tuesday); 2026-04-22 (KEV addition)

CVE: CVE-2026-33825

Source: CISA KEV April 22 | BleepingComputer | Tenable

CVE-2026-33825 is an elevation of privilege vulnerability in the Microsoft Defender Antimalware Platform. Insufficient granularity of access control allows an attacker with an initial foothold to escalate to SYSTEM-level privileges on a compromised machine. Microsoft disclosed this as a zero-day on April 14, 2026 Patch Tuesday (167 vulnerabilities patched, 11 rated Critical). CISA confirmed active exploitation and added the CVE to the KEV catalog on April 22, 2026. Affected platforms include Windows 10/11, Windows Server 2019/2022/2025, and Microsoft 365 Apps for Enterprise.

[CRITICAL] Microsoft SharePoint Server CVE-2026-32201 — Actively Exploited Spoofing Zero-Day

Date: 2026-04-14 (Patch Tuesday disclosure)

CVE: CVE-2026-32201

Source: BleepingComputer | Tenable | Rapid7

CVE-2026-32201 is an actively exploited spoofing vulnerability in Microsoft SharePoint Server arising from an input validation weakness that enables unauthenticated, network-based spoofing attacks. Microsoft disclosed this as a zero-day in the April 14, 2026 Patch Tuesday release — one of the largest monthly updates on record at 167 CVEs. Tenable designated this as the primary actively exploited CVE in the April release cycle. Remote Desktop and BitLocker flaws addressed in the same update are also rated high-priority.

[CRITICAL] CISA KEV — Four Additional Vulnerabilities Added April 24 (Samsung, SimpleHelp, D-Link)

Date: 2026-04-24

CVE: CVE-2024-7399, CVE-2024-57726, CVE-2024-57728, CVE-2025-29635

Source: CISA KEV April 24 Addition

CISA added four vulnerabilities to the KEV catalog on April 24, 2026, all confirmed actively exploited in the wild. CVE-2024-7399 is a path traversal vulnerability in Samsung MagicINFO 9 Server. CVE-2024-57726 (Missing Authorization) and CVE-2024-57728 (Path Traversal) both affect SimpleHelp remote support software — commonly deployed in managed service environments. CVE-2025-29635 is a command injection vulnerability in D-Link DIR-823X routers. FCEB agencies must remediate all four by May 4, 2026.

3. Important Developments

[IMPORTANT]  Apple iOS/iPadOS CVE-2026-28950 — Deleted Notification Retention Enabling Forensic Extraction

Date: 2026-04-22 (patch release)

CVE: CVE-2026-28950

Source: Apple Support | Help Net Security | MacRumors

Apple released iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8, and iPadOS 18.7.8 on April 22, 2026 to address CVE-2026-28950, a vulnerability in the notification services subsystem. The flaw caused notifications marked for deletion to be retained on device, allowing forensic tools to reconstruct Signal message previews even after the application was deleted. Apple confirmed the FBI used this technique to extract deleted Signal messages. The fix implements improved data redaction in the logging subsystem. All iOS 26.x and iOS 18.x devices on prior versions remain affected.

[IMPORTANT]  ADT Confirmed Breach — 5.5 Million Records Exposed via ShinyHunters Extortion

Date: 2026-04-20 (confirmed disclosure)

Source: Have I Been Pwned | SharkStriker | Privacy Guides

ADT confirmed a data breach on April 20, 2026 following ShinyHunters listing the company on its extortion site in a “pay or leak” scheme. The breach exposed 5.5 million unique email addresses along with names, phone numbers, and physical addresses. ADT notified law enforcement and engaged third-party cybersecurity experts. Have I Been Pwned has indexed the dataset. This follows the Vercel breach (April 19, 2026) in which ShinyHunters claimed access to developer API keys and cloud environment variables via a compromised third-party AI tool.

[IMPORTANT]  Iranian-Affiliated APT — Ongoing Active Exploitation of Internet-Facing PLCs Across US Critical Infrastructure

Date: 2026-04-07 (joint advisory); exploitation ongoing

Source: CISA Advisory AA26-097A | Palo Alto Unit 42

CISA, FBI, and partner agencies issued joint advisory AA26-097A on April 7, 2026 documenting Iranian-affiliated APT actors exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure. Targeted sectors include Government Services, Water and Wastewater Systems, and Energy. The group has targeted Rockwell Automation/Allen-Bradley PLCs specifically, manipulating project files and falsifying HMI/SCADA displays. Palo Alto Unit 42 updated its threat brief on April 17 noting escalating Iranian cyber operations correlated with ongoing U.S.-Iran-Israel hostilities.

[IMPORTANT]  Fortinet FortiClient EMS — CVE-2026-21643 SQL Injection (CVSS 9.8) Actively Exploited

Date: 2026-04-04 (advisory); 2026-04-13 (KEV addition)

CVE / CVSS: CVE-2026-21643 | CVSS 9.8

Source: Greenbone | SecurityOnline | FortiGuard PSIRT

CVE-2026-21643 is an SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) that allows an unauthenticated attacker to execute arbitrary code or commands via specially crafted HTTP requests. Fortinet confirmed active exploitation in advisory FG-IR-26-099. CISA added the vulnerability to the KEV catalog on April 13. The companion zero-day CVE-2026-35616 (improper access control, unauthenticated RCE) was added to KEV on April 6. Fortinet released an out-of-band hotfix for FortiClient EMS 7.4.5 and 7.4.6; a permanent fix is expected in 7.4.7.

4. Informational Intelligence

[INFORMATIONAL]  CMMC 2.0 — November 2026 C3PAO Deadline Approaching; NIST SP 800-171 Rev 3 Mandatory for DFARS Contractors

Date: 2026-04 (ongoing)

Source: Federal News Network | Washington Technology | Accorian

Effective November 10, 2026, all new DoD contracts involving FCI or CUI will require independent C3PAO third-party assessments, ending the self-attestation period. NIST SP 800-171 Revision 3 — which tightens access control, incident response, and supply chain risk management requirements — will become mandatory for DFARS-covered contractors. The FY2026 NDAA also directs DoD to develop an AI/ML security framework and incorporate it into CMMC. Seven-month gap assessments against Rev 3 should be underway now for any contractor expecting to compete on post-November contracts.

[INFORMATIONAL]  Oracle April 2026 Critical Patch Update — Critical CVEs Addressed Across Product Portfolio

Date: 2026-04-15 (release)

Source: Oracle Security Alerts

Oracle released its April 2026 Critical Patch Update on April 15, 2026, addressing multiple vulnerabilities including CVEs rated CVSS 9.0 or higher across Oracle Database, Fusion Middleware, and related products. Oracle does not release full CVE details at time of CPU publication. Organizations running Oracle enterprise products should review the advisory and apply applicable patches within their standard patch window.

Collection Metadata: