CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

CISA added six high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog because of evidence of active exploitation. Notable entries include CVE-2026-21643 (Fortinet FortiClient EMS SQL injection, CVSS 9.1) with exploitation attempts observed since March 24, 2026, and CVE-2023-21529 (Microsoft Exchange deserialization, CVSS 8.8) which Microsoft links to actor Storm-1175 delivering Medusa ransomware; FCEB agencies are required to remediate by April 27, 2026.