# Newly exploited vulnerabilities: week of 20 to 26 April 2026 (week 17)

Source: https://junglewise.ai/threats/exploited/2026-04-20  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-04-20.json  
License: CC BY 4.0 with a link back

In the week of 20 to 26 April 2026, 14 vulnerabilities were newly recorded as exploited in the wild, 14 of them critical. The technology hit most was Cisco Catalyst SD-WAN Manager (3), followed by D-Link DIR-823X (2) and Simplehelp (2).

## Newly exploited this week

- [CVE-2024-57726: SimpleHelp privilege escalation via missing authorization in API key creation](https://junglewise.ai/threats/cve-2024-57726-simplehelp-privilege-escalation-via-missing-authorization-in-api) (critical, exploited in the wild, CVSS 9.9, exploited since 24 Apr 2026, published 24 Apr 2026)
- [CVE-2024-57728: SimpleHelp path traversal in ZIP file upload](https://junglewise.ai/threats/cve-2024-57728-simplehelp-path-traversal-in-zip-file-upload) (critical, exploited in the wild, CVSS 7.2, exploited since 24 Apr 2026, published 24 Apr 2026)
- [CVE-2024-7399: Samsung MagicINFO 9 Server path traversal](https://junglewise.ai/threats/cve-2024-7399-samsung-magicinfo-9-server-path-traversal) (critical, exploited in the wild, CVSS 9.8, exploited since 24 Apr 2026, published 24 Apr 2026)
- [CVE-2025-29635: D-Link DIR-823X command injection in set_prohibiting](https://junglewise.ai/threats/cve-2025-29635-d-link-dir-823x-command-injection-in-set-prohibiting) (critical, exploited in the wild, CVSS 7.2, exploited since 24 Apr 2026, published 24 Apr 2026)
- [CVE-2026-39987: Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass](https://junglewise.ai/threats/cve-2026-39987-marimo-pre-auth-remote-code-execution-via-terminal-websocket) (critical, exploited in the wild, CVSS 9.8, exploited since 23 Apr 2026, published 8 Apr 2026)
- [CVE-2026-33825: Microsoft Defender privilege escalation in Antimalware Platform](https://junglewise.ai/threats/cve-2026-33825-microsoft-defender-privilege-escalation-in-antimalware-platform) (critical, exploited in the wild, CVSS 7.8, exploited since 22 Apr 2026, published 14 Apr 2026)
- [CVE-2023-27351: PaperCut NG/MF authentication bypass in SecurityRequestFilter](https://junglewise.ai/threats/cve-2023-27351-papercut-ng-mf-authentication-bypass-in-securityrequestfilter) (critical, exploited in the wild, CVSS 8.2, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2024-27199: JetBrains TeamCity relative path traversal in admin interface](https://junglewise.ai/threats/cve-2024-27199-jetbrains-teamcity-relative-path-traversal-in-admin-interface) (critical, exploited in the wild, CVSS 7.3, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2025-2749: Kentico Xperience path traversal and RCE in Staging Sync Server](https://junglewise.ai/threats/cve-2025-2749-kentico-xperience-path-traversal-and-rce-in-staging-sync-server) (critical, exploited in the wild, CVSS 7.2, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2025-32975: Quest KACE Systems Management Appliance authentication bypass in SSO](https://junglewise.ai/threats/cve-2025-32975-quest-kace-systems-management-appliance-authentication-bypass-in) (critical, exploited in the wild, CVSS 10, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui) (critical, exploited in the wild, CVSS 6.1, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2026-20122: Cisco Catalyst SD-WAN Manager arbitrary file overwrite via API](https://junglewise.ai/threats/cve-2026-20122-cisco-catalyst-sd-wan-manager-arbitrary-file-overwrite-via-api) (critical, exploited in the wild, CVSS 5.4, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2026-20128: Cisco Catalyst SD-WAN Manager recoverable password storage in DCA](https://junglewise.ai/threats/cve-2026-20128-cisco-catalyst-sd-wan-manager-recoverable-password-storage-in-dca) (critical, exploited in the wild, CVSS 7.5, exploited since 20 Apr 2026, published 20 Apr 2026)
- [CVE-2026-20133: Cisco Catalyst SD-WAN Manager information disclosure](https://junglewise.ai/threats/cve-2026-20133-cisco-catalyst-sd-wan-manager-information-disclosure) (critical, exploited in the wild, CVSS 7.5, exploited since 20 Apr 2026, published 20 Apr 2026)

## Technologies hit most

1. [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager): 3 vulnerabilities
2. D-Link DIR-823X: 2 vulnerabilities
3. [Simplehelp](https://junglewise.ai/threats/technologies/simplehelp): 2 vulnerabilities
4. SimpleHelp Remote Support Software: 2 vulnerabilities
5. Cisco Catalyst Sd-Wan Manger: 1 vulnerability
6. D-Link DIR-823X firmware: 1 vulnerability
7. [Jetbrains TeamCity](https://junglewise.ai/threats/technologies/teamcity): 1 vulnerability
8. [Kentico Xperience](https://junglewise.ai/threats/technologies/xperience): 1 vulnerability
9. [Marimo](https://junglewise.ai/threats/technologies/marimo): 1 vulnerability
10. marimo (PyPI): 1 vulnerability
11. [Microsoft Defender](https://junglewise.ai/threats/technologies/defender): 1 vulnerability
12. Microsoft Defender Antimalware Platform: 1 vulnerability
13. [PaperCut MF](https://junglewise.ai/threats/technologies/mf): 1 vulnerability
14. [PaperCut NG](https://junglewise.ai/threats/technologies/ng): 1 vulnerability
15. [Quest KACE Systems Management Appliance](https://junglewise.ai/threats/technologies/kace-systems-management-appliance): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 20 to 26 April 2026 (week 17)", https://junglewise.ai/threats/exploited/2026-04-20, 2 October 2026.