Keypoints
- CRIL tracked 1,675 vulnerabilities in one week, signaling sustained high disclosure volume across enterprise, cloud, and AI ecosystems.
- More than 205 vulnerabilities have public Proof-of-Concept exploits, accelerating attacker weaponization timelines.
- CISA added 10 vulnerabilities to its KEV catalog, confirming active exploitation in the wild (including SharePoint and FortiClient issues).
- Critical enterprise flaws highlighted include CVE-2026-32201 (Microsoft SharePoint) and CVE-2026-21643 (Fortinet FortiClient EMS), both enabling significant compromise risk.
- AI frameworks and developer tooling (OpenClaw, Flowise, ShowDoc) are increasingly targeted, with large-scale RCE exploitation and web shell deployments reported.
- Industrial control exposures persist: CISA issued ICS advisories for Contemporary Controls, Mitsubishi Electric, and GPL Odorizers, with some devices unpatchable and requiring isolation or replacement.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – Remote code execution and other vulnerabilities were actively exploited in internet-facing services and platforms. (‘A remote code execution vulnerability in ShowDoc… saw a sharp rise in exploitation’ / ‘CVE-2026-32201 is an actively exploited vulnerability’).
- [T1505.003 ] Web Shell – Attackers deployed web shells on unpatched servers to seize control of documentation and web environments. (‘attackers are reportedly targeting unpatched servers to deploy web shells and seize control of documentation environments’).
- [T1059 ] Command and Scripting Interpreter – Deployed web shells and malicious payloads allowed remote command execution and control. (‘deploy web shells and seize control’ / ‘malicious payload execution’).
- [T1078 ] Valid Accounts – Exposed plaintext authentication data and credential harvesting enabled use of valid accounts for follow-on access. (‘expose sensitive configuration and authentication data in plaintext’ / ‘harvest credentials’).
- [T1021 ] Remote Services – Threat actors moved laterally through connected systems using remote service access after initial compromise. (‘move laterally through connected systems’ / ‘pivot deeper into OT networks’).
- [T1068 ] Exploitation for Privilege Escalation – Vulnerabilities and harvested credentials were used to escalate privileges rapidly within affected environments. (‘an attacker with minimal access could harvest credentials and escalate privileges rapidly’).
- [T1566 ] Phishing – Exploitation of Outlook desktop client could enable or enhance phishing campaigns and delivery of malicious payloads. (‘exploitation may enable phishing enhancement, malicious payload execution’).
Indicators of Compromise
- [CVE ] Tracked and referenced vulnerability identifiers – CVE-2026-32201, CVE-2026-21643, and 1,673 other vulnerabilities tracked by CRIL during the week.
- [Affected product / system ] Notable targeted software and systems referenced as compromise vectors – Microsoft SharePoint Server, Fortinet FortiClient EMS, OpenClaw AI Agent Framework, Adobe ColdFusion (examples from top flaws).
Read more: https://cyble.com/blog/cyble-weekly-vulnerability-report-apr-23/