Exploited Vulnerabilities

CISA's Apr 20-24 KEV additions made exposure validation the top operational theme. The affected surfaces include Cisco Catalyst SD-WAN Manager, PaperCut NG/MF, JetBrains TeamCity, Microsoft Defender, Marimo, D-Link DIR-823X, Samsung MagicINFO and SimpleHelp. The practical task is to prove whether these products exist, whether they are reachable, and who owns remediation exceptions.

• Use CISA KEV dates and due dates as the review queue, but enrich them with internal asset ownership and business criticality.
• Cisco SD-WAN entries deserve special handling because CISA paired KEV additions with emergency directive and hunt guidance.
• Remote support and administration tools should be checked for internet exposure, weak segmentation and missing audit logs.
• Known ransomware-use flags on PaperCut and TeamCity should push backup, credential and lateral-movement review alongside patch status.

2 signals · CISA Cisco SD-WAN Emergency Directive, CISA KEV Catalog, Cisco Security Advisory, The Hacker News

AI & Exposure Management

Microsoft and Unit 42 both emphasized that AI changes the speed and scope of defensive work. Microsoft focused on AI-assisted vulnerability discovery, exposure management and rapid detections. Unit 42 showed why autonomous cloud attack testing and agentic workflows force defenders to reason about privileges, reachable data and guardrails before incidents happen.

• Treat AI risk as an exposure-management problem first: assets, code, permissions, internet-facing surfaces and hygiene.
• Separate AI-assisted discovery from automated exploitation claims unless a primary source supports the claim.
• For cloud and agentic systems, map what an automated workflow can read, change, execute and exfiltrate.
• Detection engineering should include model-assisted speed, but human review remains necessary for priority and context.

2 signals · Microsoft Security Blog, Microsoft Security Exposure Management, Unit 42, Unit 42 Threat Bulletin

Identity, SaaS & Browser Control Planes

Identity risk moved beyond sign-in logs. Microsoft highlighted remote IT worker detection across Workday, DocuSign, Teams, Zoom, Webex and Microsoft 365. Unit 42's April bulletin added browser extensions and AI-agent input handling as identity-bearing surfaces where ordinary-looking user workflows can become data access paths.

• Coordinate HR, identity and security operations around external applicants, new hires and suspicious SaaS activity.
• Review browser extension controls with the same seriousness as third-party SaaS and endpoint software.
• Monitor external collaboration and helpdesk workflows for unusual access requests, remote-control tooling and data staging.
• For AI agents, treat web pages, documents and database content as potentially active instruction sources, not passive text.

2 signals · Microsoft Security Blog, Unit 42 Threat Bulletin

Software Supply Chain

Unit 42's npm research and FortiGuard's ActiveMQ signal both point to a practical supply-chain lesson: trust paths are exploitable when developer credentials, package lifecycle scripts, CI/CD secrets and middleware management interfaces are not constrained. The defensive priority is to reduce blast radius before one compromised component becomes an environment-wide incident.

• Disable or tightly govern package lifecycle scripts where build pipelines do not require them.
• Rotate exposed developer, npm, GitHub and cloud tokens when package compromise is plausible.
• Audit repositories for unauthorized workflow files, unexpected package version bumps and new public repositories.
• For ActiveMQ, restrict management interfaces and monitor abnormal Jolokia or Java child-process activity.

2 signals · CISA KEV Catalog, FortiGuard Labs, Unit 42

• Build a single Apr 20-26 exposure register for CISA KEV items, including asset owner, internet exposure, patch state, mitigation state and exception reason.
• Ask identity and HR system owners to review Workday, DocuSign, Teams, Zoom, Webex and Microsoft 365 telemetry for suspicious external-user and new-hire patterns.
• Review npm, GitHub, CI/CD and cloud-token controls: lifecycle scripts, token scope, rotation process, workflow creation and artifact download visibility.
• For AI and agentic workflows, document what each agent can read, change, execute and export before expanding deployment.

CISA KEV Catalog: CISA KEV additions span Cisco SD-WAN, PaperCut, TeamCity and Microsoft DefenderCISA Cisco SD-WAN Emergency Directive: Cisco SD-WAN risk is treated as emergency exposure, not routine patchingMicrosoft Security Blog: Microsoft: AI compresses vulnerability discovery and exploitation timelinesUnit 42: Unit 42 cloud AI research turns agent privilege into a design questionMicrosoft Security Blog: Microsoft publishes detection strategies for infiltrating IT workersUnit 42 Threat Bulletin: Unit 42 highlights browser extensions and prompt injection as AI-era trust issues