# Newly exploited vulnerabilities: week of 13 to 19 April 2026 (week 16)

Source: https://junglewise.ai/threats/exploited/2026-04-13  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-04-13.json  
License: CC BY 4.0 with a link back

In the week of 13 to 19 April 2026, 10 vulnerabilities were newly recorded as exploited in the wild, 10 of them critical. The technology hit most was Adobe Acrobat (2), followed by Adobe AIR (2) and Adobe Flash Player (2).

## Newly exploited this week

- [CVE-2026-34197: Apache ActiveMQ code injection in Jolokia JMX-HTTP bridge](https://junglewise.ai/threats/cve-2026-34197-apache-activemq-code-injection-in-jolokia-jmx-http-bridge) (critical, exploited in the wild, CVSS 8.8, exploited since 16 Apr 2026, published 7 Apr 2026)
- [CVE-2026-32201: Microsoft SharePoint Server improper input validation spoofing vulnerability](https://junglewise.ai/threats/cve-2026-32201-microsoft-sharepoint-server-improper-input-validation-spoofing) (critical, exploited in the wild, CVSS 6.5, exploited since 14 Apr 2026, published 14 Apr 2026)
- [CVE-2009-0238: Microsoft Excel remote code execution via malformed object](https://junglewise.ai/threats/cve-2009-0238-microsoft-excel-remote-code-execution-via-malformed-object) (critical, exploited in the wild, CVSS 9.3, exploited since 14 Apr 2026, published 14 Apr 2026)
- [CVE-2023-36424: Microsoft Windows privilege escalation in Common Log File System Driver](https://junglewise.ai/threats/cve-2023-36424-microsoft-windows-privilege-escalation-in-common-log-file-system) (critical, exploited in the wild, CVSS 7.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2025-60710: Microsoft Windows privilege escalation in Host Process for Windows Tasks](https://junglewise.ai/threats/cve-2025-60710-microsoft-windows-privilege-escalation-in-host-process-for) (critical, exploited in the wild, CVSS 7.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2026-21643: Fortinet FortiClient EMS SQL injection](https://junglewise.ai/threats/cve-2026-21643-fortinet-forticlient-ems-sql-injection) (critical, exploited in the wild, CVSS 9.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2023-21529: Microsoft Exchange Server deserialization remote code execution](https://junglewise.ai/threats/cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution) (critical, exploited in the wild, CVSS 8.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2012-1854: Microsoft Visual Basic for Applications insecure library loading in VBE6.dll](https://junglewise.ai/threats/cve-2012-1854-microsoft-visual-basic-for-applications-insecure-library-loading) (critical, exploited in the wild, CVSS 7.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2020-9715: Adobe Acrobat use-after-free in PDF parsing](https://junglewise.ai/threats/cve-2020-9715-adobe-acrobat-use-after-free-in-pdf-parsing) (critical, exploited in the wild, CVSS 7.8, exploited since 13 Apr 2026, published 13 Apr 2026)
- [CVE-2026-34621: Adobe Acrobat and Reader prototype pollution in JavaScript engine](https://junglewise.ai/threats/cve-2026-34621-adobe-acrobat-and-reader-prototype-pollution-in-javascript-engine) (critical, exploited in the wild, CVSS 8.6, exploited since 13 Apr 2026, published 11 Apr 2026)

## Technologies hit most

1. [Adobe Acrobat](https://junglewise.ai/threats/technologies/acrobat): 2 vulnerabilities
2. [Adobe AIR](https://junglewise.ai/threats/technologies/air): 2 vulnerabilities
3. [Adobe Flash Player](https://junglewise.ai/threats/technologies/flash-player): 2 vulnerabilities
4. [Adobe Reader](https://junglewise.ai/threats/technologies/reader): 2 vulnerabilities
5. [Microsoft Office](https://junglewise.ai/threats/technologies/office): 2 vulnerabilities
6. [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-): 2 vulnerabilities
7. [Adobe Acrobat DC](https://junglewise.ai/threats/technologies/acrobat-dc): 1 vulnerability
8. [Adobe Acrobat Reader](https://junglewise.ai/threats/technologies/acrobat-reader): 1 vulnerability
9. [Adobe Acrobat Reader DC](https://junglewise.ai/threats/technologies/acrobat-reader-dc): 1 vulnerability
10. [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 1 vulnerability
11. [Apache ActiveMQ Broker](https://junglewise.ai/threats/technologies/activemq-broker): 1 vulnerability
12. Apache ActiveMQ Classic: 1 vulnerability
13. [Fortinet FortiClient EMS](https://junglewise.ai/threats/technologies/forticlient-ems): 1 vulnerability
14. [Microsoft Excel](https://junglewise.ai/threats/technologies/excel): 1 vulnerability
15. Microsoft Excel Viewer: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 13 to 19 April 2026 (week 16)", https://junglewise.ai/threats/exploited/2026-04-13, 2 October 2026.