Cybersecurity — 2026-04-15
CISA Adds Six Actively Exploited Flaws to KEV Catalog Including Critical Fortinet Zero-Day
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-21643, a critical SQL injection flaw in Fortinet
Analysis
Pre-authentication RCE against FortiClient EMS is categorically worse than a typical endpoint flaw; EMS controls managed devices, so a single exploitation event cascades lateral access across the entire managed fleet. The parallel Brickstorm update confirms PRC-linked actors have migrated to Rust-based variants, which invalidates existing detection signatures built against prior iterations; both disclosures land simultaneously, though the six-CVE KEV batch may reflect catalog backlog clearance rather than a correlated campaign.
Pre-authentication RCE against FortiClient EMS is categorically worse than a typical endpoint flaw; EMS controls managed devices, so a single exploitation event cascades lateral access across the entire managed fleet. The parallel Brickstorm update confirms PRC-linked actors have migrated to Rust-based variants, which invalidates existing detection signatures built against prior iterations; both disclosures land simultaneously, though the six-CVE KEV batch may reflect catalog backlog clearance rather than a correlated campaign.