Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 13 to 19 April 2026 (week 16)
Final report, published . It does not change.
In the week of 13 to 19 April 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was Adobe Acrobat (2), followed by Adobe AIR (2) and Adobe Flash Player (2).
- Newly exploited
- 10
- Critical
- 10
- Technologies hit
- 15
Newly exploited this week
- CVE-2026-34197: Apache ActiveMQ code injection in Jolokia JMX-HTTP bridgecriticalCVSS 8.8Exploited since Published Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ Classic
- CVE-2026-32201: Microsoft SharePoint Server improper input validation spoofing vulnerabilitycriticalCVSS 6.5Exploited since Published Microsoft Sharepoint-Server, Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2016 Enterprise Edition
- CVE-2009-0238: Microsoft Excel remote code execution via malformed objectcriticalCVSS 9.3Exploited since Published Microsoft Excel, Microsoft Excel Viewer, Microsoft Office
- CVE-2023-36424: Microsoft Windows privilege escalation in Common Log File System DrivercriticalCVSS 7.8Exploited since Published Microsoft Windows
- CVE-2025-60710: Microsoft Windows privilege escalation in Host Process for Windows TaskscriticalCVSS 7.8Exploited since Published Microsoft Windows, Microsoft Windows 11 24h2, Microsoft Windows 11 25h2
- CVE-2026-21643: Fortinet FortiClient EMS SQL injectioncriticalCVSS 9.8Exploited since Published Fortinet FortiClient EMS
- CVE-2023-21529: Microsoft Exchange Server deserialization remote code executioncriticalCVSS 8.8Exploited since Published Microsoft Exchange Server
- CVE-2012-1854: Microsoft Visual Basic for Applications insecure library loading in VBE6.dllcriticalCVSS 7.8Exploited since Published Microsoft Office, Microsoft Office, Microsoft Office
- CVE-2020-9715: Adobe Acrobat use-after-free in PDF parsingcriticalCVSS 7.8Exploited since Published Adobe Acrobat, Adobe Acrobat DC, Adobe Acrobat Reader DC
- CVE-2026-34621: Adobe Acrobat and Reader prototype pollution in JavaScript enginecriticalCVSS 8.6Exploited since Published Adobe Acrobat, Adobe Acrobat Reader, Adobe AIR
Technologies hit most
- 1.Adobe Acrobat2 vulnerabilities
- 2.Adobe AIR2 vulnerabilities
- 3.Adobe Flash Player2 vulnerabilities
- 4.Adobe Reader2 vulnerabilities
- 5.Microsoft Office2 vulnerabilities
- 6.Microsoft Windows2 vulnerabilities
- 7.Adobe Acrobat DC1 vulnerability
- 8.Adobe Acrobat Reader1 vulnerability
- 9.Adobe Acrobat Reader DC1 vulnerability
- 10.Apache ActiveMQ1 vulnerability
- 11.Apache ActiveMQ Broker1 vulnerability
- 12.Apache ActiveMQ Classic1 vulnerability
- 13.Fortinet FortiClient EMS1 vulnerability
- 14.Microsoft Excel1 vulnerability
- 15.Microsoft Excel Viewer1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-04-13.json, and this page as text at https://junglewise.ai/threats/exploited/2026-04-13.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 13 to 19 April 2026 (week 16)", https://junglewise.ai/threats/exploited/2026-04-13, 2 October 2026.