CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

CISA has added six actively exploited security vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting Fortinet, Microsoft, and Adobe products.

• •CVE-2026-21643 (CVSS 9.1) is an SQL injection in Fortinet FortiClient EMS enabling unauthenticated remote code execution, with exploitation confirmed since March 24, 2026.
• •CVE-2023-21529 (CVSS 8.8) is a deserialization flaw in Microsoft Exchange Server being weaponized by Storm-1175 to deliver Medusa ransomware.
• •CVE-2020-9715 (CVSS 7.8) is a use-after-free vulnerability in Adobe Acrobat Reader causing remote code execution.
• •CVE-2025-60710 (CVSS 7.8) and CVE-2023-36424 (CVSS 7.8) enable privilege escalation in Windows components through improper link resolution and out-of-bounds reads.
• •