← Back to Vulnerability Reports

Vulnerability Priority Report – Week 2 of April 2026

📅 April 13 – 19•🤖 AI-Generated Analysis•10 CVEs analyzed
5 critical
8 high
6 medium
19 total

Analyst Guidance

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US critical infrastructure PLCs, while Marimo's pre-auth RCE and Adobe Reader flaws are under widespread exploitation. Immediate action is required for all critical-rated vulnerabilities, with particular focus on supply chain compromises and OT device exposure.

Patch Priority Matrix

CRITICAL - Active Exploitation

Pre-authenticated RCE in Marimo exploited within 10 hours of disclosure affecting all versions prior to patched release. Iranian threat actors actively exploiting PLC vulnerabilities across US critical infrastructure with thousands of exposed Rockwell Automation devices identified.

CVE-2026-39987 • CVE-2026-41205 • CVE-2026-41206

CRITICAL - Supply Chain & Enterprise

Adobe Acrobat Reader CVE-2026-34621 under active exploitation with CVSS 8.6. Backdoored Smart Slider 3 Pro update compromised plugin with 800K+ installations. Immediate patching of all affected systems required.

CVE-2026-34621 • CVE-2026-38904

HIGH - Critical Infrastructure OT

Multiple OT vulnerabilities in Yokogawa CENTUM VP, Mitsubishi Electric GENESIS64, Contemporary Controls BASC 20T, and Hitachi Energy Ellipse affecting process control and credential disclosure. Local attacker access can lead to permission modifications and SQL credential compromise.

CVE-2026-36401 • CVE-2026-36402 • CVE-2026-36885 • CVE-2026-37104

HIGH - Known Exploited Catalog Additions

CISA has added multiple vulnerabilities to KEV Catalog with evidence of active exploitation. Analysis shows most critical flaws are exploited before defenders can patch, indicating systematic remediation delays across organizations.

CVE-2026-41112 • CVE-2026-41113

CVE Details & Remediation

CVE-2026-39987 – Marimo (Python Notebook)

CVSS: 9.3   Status: Active Exploit   Action: Patch immediately

Affected Industries: Technology Finance Education Government

Remediation Steps

  1. Immediately update Marimo to patched version released after April 7, 2026
  2. Audit all Marimo instances for unauthorized access logs and credential compromise
  3. Isolate affected instances from network if updates cannot be applied within 2 hours
  4. Scan for IOCs associated with CVE-2026-39987 exploitation
  5. Review data science notebooks for suspicious code injection or data exfiltration

References:

CVE-2026-34621 – Adobe Acrobat Reader

CVSS: 8.6   Status: Active Exploit   Action: Patch immediately

Affected Industries: Technology Finance Government Legal Healthcare

Remediation Steps

  1. Deploy Adobe Acrobat Reader emergency patch released April 2026 to all endpoints
  2. Implement application control to block execution of unpatched Reader versions
  3. Disable JavaScript execution in Adobe Reader as temporary mitigation if patching delayed
  4. Monitor for exploitation attempts using EDR/XDR tools with CVE-2026-34621 signatures
  5. Educate users against opening untrusted PDF attachments

References:

CVE-2026-41205 – Rockwell Automation PLC (Multiple)

CVSS: 9.1   Status: Active Exploit   Action: Patch immediately

Affected Industries: Energy Manufacturing Government Transportation

Remediation Steps

  1. Inventory all exposed Rockwell Automation PLC devices connected to internet or corporate network
  2. Apply manufacturer security patches immediately to air-gapped or segmented instances
  3. Implement network segmentation to isolate PLCs from internet-facing systems
  4. Deploy industrial network monitoring to detect unauthorized PLC enumeration or configuration changes
  5. Coordinate with facility operations to validate patch compatibility before production deployment

References:

CVE-2026-36401 – Yokogawa CENTUM VP

CVSS: 8.2   Status: Under Review   Action: Patch this week

Affected Industries: Energy Manufacturing Government

Remediation Steps

  1. Review Yokogawa CENTUM VP versions in use against affected versions list
  2. Apply security update from Yokogawa for privilege escalation and PROG user access
  3. Change default and shared credentials for PROG and admin accounts immediately
  4. Audit permission modifications and user access logs for unauthorized changes
  5. Test patches in staging environment before production deployment

References:

CVE-2026-36402 – Mitsubishi Electric GENESIS64 & ICONICS Suite

CVSS: 7.9   Status: Under Review   Action: Patch this week

Affected Industries: Energy Manufacturing Government Transportation

Remediation Steps

  1. Identify all systems running affected GENESIS64 and ICONICS Suite versions
  2. Rotate all SQL Server credentials used by these products immediately
  3. Apply vendor security patches from Mitsubishi Electric
  4. Audit SQL Server access logs for unauthorized credential usage or data access
  5. Implement principle of least privilege for product-specific SQL accounts

References:

CVE-2026-36885 – Contemporary Controls BASC 20T

CVSS: 8.1   Status: Under Review   Action: Patch this week

Affected Industries: Energy Manufacturing Government

Remediation Steps

  1. Update BASC 20T firmware to patched version from Contemporary Controls
  2. Restrict network access to PLC configuration interfaces using firewall rules
  3. Audit all PLC component enumeration, configuration, and deletion activities
  4. Document baseline PLC configuration for drift detection
  5. Implement monitoring for unauthorized rename, delete, or reconfiguration attempts

References:

CVE-2026-37104 – Hitachi Energy Ellipse

CVSS: 7.7   Status: Under Review   Action: Patch this week

Affected Industries: Energy Manufacturing Government

Remediation Steps

  1. Patch Jasper Report vulnerability in Hitachi Energy Ellipse to latest version
  2. Review exposed Ellipse instances for exploitation indicators
  3. Implement WAF rules to protect against known Jasper Report exploitation techniques
  4. Apply vendor security updates from Hitachi Energy
  5. Monitor for suspicious report generation or data export activities

References:

CVE-2026-38904 – Smart Slider 3 Pro Plugin

CVSS: 8.4   Status: Active Exploit   Action: Patch within 48 hours

Affected Industries: Technology Media Retail Education

Remediation Steps

  1. Immediately update Smart Slider 3 Pro to version 3.5.1.36 or later (skip compromised 3.5.1.35)
  2. Scan all affected WordPress/Joomla sites for backdoor persistence mechanisms
  3. Change all administrative credentials for affected CMS instances
  4. Review server access logs for unauthorized administrative activity
  5. Consider temporary disabling of the plugin pending forensic review

References:

CVE-2026-41112 – Multiple (CISA KEV Catalog)

CVSS: 8.3   Status: Active Exploit   Action: Patch immediately

Affected Industries: Government Finance Technology Healthcare

Remediation Steps

  1. Review latest CISA Known Exploited Vulnerabilities Catalog for newly added entries
  2. Prioritize patching of all KEV-listed vulnerabilities with exploitation evidence
  3. Implement automated detection for KEV vulnerabilities in vulnerability management tools
  4. Establish SLA of 48 hours for remediation of active KEV exploits
  5. Subscribe to CISA KEV Catalog RSS feeds for real-time alerts

References:

CVE-2026-36780 – GPL Odorizers GPL750

CVSS: 7.5   Status: Under Review   Action: Schedule for next cycle

Affected Industries: Energy Government Manufacturing

Remediation Steps

  1. Inventory GPL750 systems and document exposed instances
  2. Apply security patches from GPL Odorizers when available
  3. Implement access controls to limit remote access to odorant system controls
  4. Monitor register value changes for anomalies indicating manipulation attempts
  5. Coordinate with facility operations to validate patches before deployment

References:

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.

Get Weekly Vulnerability Reports

Subscribe free and stay on top of critical patches.