Executive Summary
On April 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding eight new vulnerabilities, citing evidence of active exploitation. These vulnerabilities affect a range of products, including PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance, Synacor Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager. The inclusion of these vulnerabilities underscores the persistent threat posed by unpatched software flaws, which can serve as entry points for malicious actors to compromise systems and exfiltrate sensitive data.
The addition of these vulnerabilities to the KEV Catalog highlights the evolving landscape of cyber threats, where attackers continuously exploit both new and longstanding vulnerabilities. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential risks and enhance their cybersecurity posture.
Why This Matters Now
The inclusion of these vulnerabilities in the KEV Catalog emphasizes the immediate need for organizations to address these actively exploited flaws to prevent potential breaches and data loss.
Attack Path Analysis
Attackers exploited vulnerabilities in enterprise management tools to gain initial access, escalated privileges by exploiting misconfigurations, moved laterally across the network, established command and control channels, exfiltrated sensitive data, and caused operational disruptions.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited vulnerabilities in enterprise management tools such as PaperCut NG/MF (CVE-2023-27351) and JetBrains TeamCity (CVE-2024-27199) to gain unauthorized access.
Related CVEs
CVE-2024-27199
CVSS 7.3A path traversal vulnerability in JetBrains TeamCity before 2023.11.4 allows limited administrative actions.
Affected Products:
JetBrains TeamCity – < 2023.11.4
Exploit Status:
exploited in the wildCVE-2024-32975
CVSS 7.5An integer underflow in Envoy's QuicStreamSequencerBuffer::PeekRegion() can lead to a crash.
Affected Products:
Envoy Envoy – unspecified
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Valid Accounts
Exploit Public-Facing Application
Command and Scripting Interpreter
Account Discovery
Unsecured Credentials
OS Credential Dumping
Application Layer Protocol
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.05
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Federal agencies face mandatory KEV remediation requirements under BOD 22-01, with SD-WAN and authentication vulnerabilities creating critical infrastructure exposure risks.
Information Technology/IT
JetBrains TeamCity and network management platforms present significant supply chain risks, requiring immediate patching of exploited authentication and traversal vulnerabilities.
Financial Services
Banking systems using affected collaboration and management platforms face regulatory compliance violations and potential data exfiltration through exploited authentication mechanisms.
Health Care / Life Sciences
Healthcare organizations must address HIPAA compliance gaps from collaboration suite vulnerabilities while protecting sensitive patient data from active exploitation campaigns.
Sources
- CISA Adds Eight Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalogVerified
- CVE-2024-27199 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2024-27199Verified
- CVE-2024-32975 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2024-32975Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to exploit vulnerabilities, escalate privileges, move laterally, establish command and control, exfiltrate data, and cause operational disruptions by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit these vulnerabilities would likely be constrained by enforcing strict segmentation and identity-aware policies, reducing the scope of unauthorized access.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained by enforcing least-privilege access controls, reducing the scope of potential privilege escalation.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally would likely be constrained by monitoring and controlling east-west traffic, reducing the reachability of additional systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained by providing comprehensive visibility and control across multicloud environments, reducing the scope of persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate data would likely be constrained by enforcing strict egress policies, reducing the reachability of external servers.
The attacker's ability to cause operational disruptions would likely be constrained by reducing the blast radius of the attack, limiting the scope of affected systems and data.
Impact at a Glance
Affected Business Functions
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Software Development
- IT Infrastructure Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of source code repositories and build artifacts.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Deploy East-West Traffic Security controls to monitor and restrict internal traffic flows.
- • Utilize Multicloud Visibility & Control solutions to detect and respond to anomalous activities across cloud environments.
- • Apply Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Regularly update and patch enterprise management tools to mitigate known vulnerabilities.
