CISA KEV Alert: Microsoft, Adobe, and Fortinet Vulnerabilities Under Active Exploit — Detection and Remediation Guide

---
title: Potential Microsoft Exchange Deserialization Attack (CVE-2023-21529)
id: 8a5c9b12-d3e4-4f7a-9b10-c2d3e4f5a6b7
status: experimental
description: Detects suspicious PowerShell activity in Exchange backend indicative of deserialization attack attempts
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/13
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2023.21529
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|contains: '\Exchange Server\V15\Bin\'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'System.Management.Automation.Serialization'
      - 'Deserialize'
      - 'MemoryStream'
  condition: selection
falsepositives:
  - Legitimate Exchange management activities
level: high
---
title: Fortinet SQL Injection Exploitation Attempt (CVE-2026-21643)
id: 1b4d8c23-e4f5-5a8b-0c2d-e3f4a5b6c7d8
status: experimental
description: Detects SQL injection patterns targeting Fortinet management interfaces
references:
  - https://fortiguard.com/psirt/FG-IR-26-XXX
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/13
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.21643
logsource:
  category: webserver
  product: fortinet
detection:
  selection:
    c-uri|contains:
      - '/api/'
      - '/mgmt/'
    cs-method:
      - 'POST'
      - 'GET'
    cs-uri-query|contains:
      - "' OR "
      - "'--"
      - "/* */"
      - "UNION SELECT"
  condition: selection
falsepositives:
  - False positives are unlikely with these specific SQLi patterns
level: critical
---
title: Suspicious Adobe Acrobat JavaScript Activity (CVE-2020-9715, CVE-2026-34621)
id: 3c5e9d34-f5a6-6b9c-1d2e-f4g5h6i7j8k9
status: experimental
description: Detects potential exploit attempts via suspicious JavaScript in PDF files
references:
  - https://helpx.adobe.com/security.html
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/13
tags:
  - attack.initial_access
  - attack.t1566.001
  - cve.2020.9715
  - cve.2026.34621
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\Adobe\Acrobat\'
    Image|endswith:
      - '\AcroRd32.exe'
      - '\Acrobat.exe'
  filter_legit:
    TargetFilename|endswith:
      - '.pdf'
      - '.tmp'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate temporary files created during normal PDF operations
level: medium

// Hunt for Exchange PowerShell deserialization activity (CVE-2023-21529)
let SuspiciousExchangePowerShell =
DeviceProcessEvents
| where InitiatingProcessFolderPath contains "Exchange Server"
| where FolderPath endswith "\\powershell.exe"
| where ProcessCommandLine has_any ("System.Management.Automation.Serialization", "Deserialize", "MemoryStream", "ObjectDeserialization")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFolderPath, ProcessCommandLine, FileName
| order by Timestamp desc;
SuspiciousExchangePowerShell

// Detect Fortinet SQL Injection attempts (CVE-2026-21643)
let FortinetSQLi =
CommonSecurityLog
| where DeviceVendor in ("Fortinet", "FortiGate")
| where RequestURL contains_any ("/api/", "/mgmt/")
| where RequestMethod in ("POST", "GET")
| where RequestURL has_any ("' OR ", "'--", "/* */", "UNION SELECT", "1=1", ";--")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, RequestURL, RequestMethod, RequestPayload
| order by TimeGenerated desc;
FortinetSQLi

// Hunt for suspicious file creations by Acrobat/Reader processes
let AcrobatSuspiciousFiles =
DeviceFileEvents
| where InitiatingProcessFileName in~ ("AcroRd32.exe", "Acrobat.exe")
| where not (FolderPath endswith ".pdf" or FolderPath endswith ".tmp")
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, SHA256, SHA1
| order by Timestamp desc;
AcrobatSuspiciousFiles

-- Hunt for suspicious PowerShell processes spawned by Exchange (CVE-2023-21529)
SELECT Pid, Name, CommandLine, Exe, ParentPid, Username, CreateTime
FROM pslist()
WHERE Name =~ "powershell.exe"
  AND ParentPid IN (SELECT Pid FROM pslist() WHERE Exe =~ "Exchange")
  AND CommandLine =~ "(Serialize|Deserialize|MemoryStream)"

-- Scan for suspicious files created by Adobe applications
SELECT FullPath, Size, Mtime, Atime, Btime
FROM glob(globs="/*", root="/Users/*/AppData/Local/Temp")
WHERE FullPath =~ ".(exe|dll|vbs|js)$"
  AND Mtime > now() - 1h
  AND FullPath NOT =~ "\\AppData\\Local\\Temp\\adobe.*\\.*\.tmp$"

-- Check for Fortinet access logs with SQL injection patterns
SELECT timestamp, source_ip, dest_ip, dest_port, url, user_agent
FROM read_file(accessor="auto", path="/var/log/fortigate/access.log")
WHERE url =~ "(' OR |'--|UNION SELECT|1=1|;--)"
  AND timestamp > now() - 24h

# Check and remediate Microsoft Exchange CVE-2023-21529
function Check-ExchangeVulnerability {
    Write-Host "Checking Microsoft Exchange Server for CVE-2023-21529..." -ForegroundColor Cyan
    
    # Determine Exchange version
    $exchangePath = "${env:ProgramFiles}\Microsoft\Exchange Server\V15\Bin"
    if (Test-Path $exchangePath) {
        $exchangeVersion = (Get-Item "$exchangePath\ExSetup.exe").VersionInfo.FileVersion
        Write-Host "Exchange Version: $exchangeVersion" -ForegroundColor Yellow
        
        # Check against vulnerable versions
        $vulnerableVersions = @("15.0","15.1","15.2")
        foreach ($ver in $vulnerableVersions) {
            if ($exchangeVersion.StartsWith($ver)) {
                Write-Host "[!] VULNERABLE: Exchange Server requires immediate patching." -ForegroundColor Red
                Write-Host "Download update from: https://www.microsoft.com/en-us/download/details.aspx?id=XXXXXX" -ForegroundColor Yellow
                return $false
            }
        }
        Write-Host "[+] Exchange Server appears to be patched." -ForegroundColor Green
        return $true
    }
    Write-Host "[-] Exchange Server not found on this system." -ForegroundColor Gray
    return $true
}

# Check for Windows vulnerabilities (CVE-2023-36424, CVE-2025-60710)
function Check-WindowsVulnerabilities {
    Write-Host "Checking Windows for CVE-2023-36424 and CVE-2025-60710..." -ForegroundColor Cyan
    
    # Get current OS build
    $osBuild = [System.Environment]::OSVersion.Version
    $buildNumber = $osBuild.Build
    
    # Define minimum patched builds
    $patchedBuilds = @{
        "10240" = "19658"  # Windows 10 1507
        "14393" = "6306"   # Windows 10 1607
        "17763" = "5458"   # Windows 10 1809
        "18362" = "1854"   # Windows 10 1903
        "19041" = "3393"   # Windows 10 2004
        "19044" = "4291"   # Windows 10 21H2
        "19045" = "4291"   # Windows 10 22H2
        "22000" = "2713"   # Windows 11 21H2
        "22621" = "3235"   # Windows 11 22H2
    }
    
    $osVersion = Get-WmiObject -Class Win32_OperatingSystem
    $displayVersion = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion
    
    Write-Host "OS Version: Windows $($osVersion.Caption) $displayVersion" -ForegroundColor Yellow
    Write-Host "OS Build: $buildNumber" -ForegroundColor Yellow
    
    # This is a simplified check - actual implementation would require exact patch validation
    Write-Host "[+] Ensure cumulative updates from April 2026 are installed." -ForegroundColor Yellow
    Write-Host "Download updates from: https://www.catalog.update.microsoft.com/" -ForegroundColor Yellow
    
    # Check for Visual Basic for Applications vulnerability (CVE-2012-1854)
    Write-Host "Checking for Office CVE-2012-1854..." -ForegroundColor Cyan
    $officePath = "${env:CommonProgramFiles}\Microsoft Shared\VBA\VBA7"
    if (Test-Path $officePath) {
        $vbaVersion = (Get-Item "$officePath\VBE7.DLL").VersionInfo.FileVersion
        Write-Host "VBA Version: $vbaVersion" -ForegroundColor Yellow
        
        if ([version]$vbaVersion -lt [version]"7.1.0.0") {
            Write-Host "[!] VULNERABLE: Office installation requires updating." -ForegroundColor Red
            Write-Host "Install Office security updates from: https://www.microsoft.com/en-us/download/details.aspx?id=XXXXXX" -ForegroundColor Yellow
        } else {
            Write-Host "[+] VBA appears to be patched." -ForegroundColor Green
        }
    }
}

# Check for Adobe vulnerabilities (CVE-2020-9715, CVE-2026-34621)
function Check-AdobeAcrobat {
    Write-Host "Checking Adobe Acrobat for CVE-2020-9715 and CVE-2026-34621..." -ForegroundColor Cyan
    
    $adobePaths = @(
        "${env:ProgramFiles}\Adobe\Acrobat DC",
        "${env:ProgramFiles(x86)}\Adobe\Acrobat DC",
        "${env:ProgramFiles}\Adobe\Acrobat Reader DC",
        "${env:ProgramFiles(x86)}\Adobe\Acrobat Reader DC"
    )
    
    $foundAdobe = $false
    foreach ($path in $adobePaths) {
        if (Test-Path $path) {
            $foundAdobe = $true
            $exePath = Join-Path $path "Acrobat\Acrobat.exe"
            if (-not (Test-Path $exePath)) {
                $exePath = Join-Path $path "Reader\AcroRd32.exe"
            }
            
            if (Test-Path $exePath) {
                $version = (Get-Item $exePath).VersionInfo.FileVersion
                Write-Host "Adobe Acrobat/Reader found at: $path" -ForegroundColor Yellow
                Write-Host "Version: $version" -ForegroundColor Yellow
                
                # Check against patched versions
                if ([version]$version -lt [version]"24.004.20280") {
                    Write-Host "[!] VULNERABLE: Adobe Acrobat/Reader requires immediate update." -ForegroundColor Red
                    Write-Host "Update from: https://helpx.adobe.com/acrobat/using/updates.html" -ForegroundColor Yellow
                } else {
                    Write-Host "[+] Adobe Acrobat/Reader appears to be patched." -ForegroundColor Green
                }
            }
        }
    }
    
    if (-not $foundAdobe) {
        Write-Host "[-] Adobe Acrobat/Reader not found on this system." -ForegroundColor Gray
    }
}

# Execute all checks
Check-ExchangeVulnerability
Check-WindowsVulnerabilities
Check-AdobeAcrobat

Write-Host ""
Write-Host "REMEDIATION STEPS:" -ForegroundColor Cyan
Write-Host "1. Apply all security updates immediately." -ForegroundColor White
Write-Host "2. Restart affected services after patching." -ForegroundColor White
Write-Host "3. Verify patch installation using the provided checks." -ForegroundColor White
Write-Host "4. Monitor systems for signs of exploitation." -ForegroundColor White
Write-Host "5. For Fortinet devices, apply firmware updates from FortiGuard." -ForegroundColor White

   Set-PSSessionConfiguration -Name Microsoft.Exchange -ShowSecurityDescriptorUI

   Get-ExchangeServer | Format-List Name, AdminDisplayVersion

   Get-HotFix | Where-Object {$_.InstalledOn -gt (Get-Date).AddDays(-30)}