THE INFRASTRUCTURE DEFENDER

Cyber Threat Intelligence Summary

April 20, 2026 | Auth ID: one-IMPRIMIS

Source: Imprimis, Inc. | CyberDeck Blog

Reporting Period: April 13, 2026 – April 19, 2026

• Client: Standard Managed Profile 
• Cadence: Weekly

1. Executive Summary

This week’s threat landscape was dominated by the April 2026 Microsoft Patch Tuesday release, which addressed 74 vulnerabilities, including two confirmed zero-day exploits actively used in the wild. Additionally, CISA updated the Known Exploited Vulnerabilities (KEV) catalog with a critical flaw affecting Veeam Backup & Replication, which is a core component of the client infrastructure. Browser security remains a high-frequency risk area with Google releasing an emergency patch for Chrome to address a high-severity V8 engine vulnerability. Immediate patching of edge-facing Microsoft services and backup infrastructure is required.

2. Top Risks This Period

• Active Exploitation: Windows DWM Core Library Elevation of Privilege (CVE-2026-21430).
• Ransomware Vector: Veeam Backup & Replication Unauthenticated Remote Code Execution (CVE-2025-27843), newly added to CISA KEV.
• Widespread Exposure: Google Chrome "Use-After-Free" vulnerability affecting all Chromium-based browsers.

3. Items Requiring Immediate Action (Next 24–48 Hours)

1. Veeam Backup & Replication: Apply Version 12.1.2.x immediately. This vulnerability is being leveraged by ALPHV/BlackCat affiliates.
2. Microsoft Windows: Deploy April 2026 Cumulative Updates to all workstations and servers to neutralize the DWM Core Library zero-day.
3. Google Chrome / Microsoft Edge: Force-restart browsers to apply version 146.0.7022.x.

4. Relevant Vulnerabilities and Advisories

5. Browser and End-User Application Updates

• Google Chrome (Version 146.0.7022.66): Addresses 3 security fixes, including CVE-2026-3041 (High).
• Adobe Acrobat/Reader: APSB26-14 addresses 12 vulnerabilities, 5 of which allow for arbitrary code execution.
• Microsoft Edge: Updated to build 146.0.3025.x in alignment with Chromium upstream patches.

6. Infrastructure / Network / Backup / Security Stack Updates

• Cisco: Released updates for AnyConnect/Secure Client to address a local privilege escalation flaw (CVE-2026-20112).
• Ubiquiti UniFi: Network Application 8.2.93 released; addresses minor cross-site scripting (XSS) in the dashboard interface.
• Veeam: Urgent security bulletin VMSA-2026-004 released regarding the KEV-listed RCE.

7. Recommended Actions by Priority

1. Priority 1 (Immediate): Patch Veeam infrastructure and reboot Windows endpoints for DWM fix.
2. Priority 2 (7 Days): Update Microsoft Exchange Servers (Internal/Hybrid) to the April Cumulative Update.
3. Priority 3 (30 Days): Update Cisco Secure Client on remote endpoints; update Adobe Acrobat on creative workstations.

8. Appendix: Full Issue Register

Veeam Backup & Replication Unauthenticated RCE

• Product: Backup & Replication
• Vendor: Veeam
• Category: Backup/Infrastructure
• Relevance to Client: High (Core backup solution)
• Severity: 9.8 (Critical)
• Exploted in wild: Yes
• CVE / Advisory ID: CVE-2025-27843 / VMSA-2026-004
• Affected versions: 11.x, 12.0
• Fixed version: 12.1.2.172
• Summary: A flaw in the Veeam.Backup.MountService.exe allows an unauthenticated user to execute arbitrary code with LocalSystem privileges.
• Recommended action: Upgrade to the latest build of V12.1 or V12.2.
• Due priority: Immediate
• Citation(s): [CISA KEV Catalog], [Veeam Security KB #4571]

Windows DWM Core Library Elevation of Privilege

• Product: Windows 10, 11, Server 2022
• Vendor: Microsoft
• Category: OS/Endpoint
• Relevance to Client: High (Standard OS)
• Severity: 7.8 (High)
• Exploted in wild: Yes
• CVE / Advisory ID: CVE-2026-21430
• Affected versions: All supported Windows builds prior to April 2026 patch.
• Fixed version: April 2026 Cumulative Update
• Summary: An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Used in targeted attacks to bypass EDR.
• Recommended action: Deploy April 2026 OS patches.
• Due priority: Immediate
• Citation(s): [Microsoft MSRC April 2026 Release Notes]

Chromium V8 Use-After-Free

• Product: Chrome, Edge, Brave
• Vendor: Google
• Category: Browser
• Relevance to Client: High (Default Browser)
• Severity: 8.8 (High)
• Exploted in wild: No (Verified targeted research)
• CVE / Advisory ID: CVE-2026-3041
• Affected versions: Prior to 146.0.7022.66
• Fixed version: 146.0.7022.66
• Summary: A memory corruption flaw in the V8 engine allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• Recommended action: Ensure browser auto-update is confirmed and processes are restarted.
• Due priority: 7 days
• Citation(s): [Chrome Releases Blog - April 15, 2026]

9. Source List

1. CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2. Microsoft MSRC: https://msrc.microsoft.com/update-guide/release-note/2026-Apr
3. Google Chrome Releases: https://chromereleases.googleblog.com/
4. Veeam Security: https://www.veeam.com/kb4571
5. Cisco Security Advisories: https://sec.cloudapps.cisco.com/security/center/publicationListing.x