--- title: "Security digest: April 20, 2026" url: https://erroneo.us/security/2026-04-20/ description: "April 20, 2026 vulnerability digest: 8 CISA KEV additions (Cisco, JetBrains, Kentico, PaperCut…); 1 critical advisory (Maven). What to patch and who can…" type: security-digest-day section: "Security Digest" date_published: 2026-04-20 date_modified: 2026-04-20 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: April 20, 2026 8 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Cisco Catalyst SD-WAN Manager, Cisco Catalyst SD-WAN Manger, Synacor Zimbra Collaboration Suite (ZCS), Quest KACE Systems Management Appliance (SMA), Kentico Kentico Xperience, JetBrains TeamCity, PaperCut NG/MF. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-23. - Maven: 1 critical advisory ( org.apache.kafka:kafka-clients ). Check with mvn dependency:tree -Dincludes=: . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2026-20133](https://erroneo.us/security/cve/CVE-2026-20133/index.md) Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CISA due 2026-04-23) - [CVE-2026-20128](https://erroneo.us/security/cve/CVE-2026-20128/index.md) Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability (CISA due 2026-04-23) - [CVE-2026-20122](https://erroneo.us/security/cve/CVE-2026-20122/index.md) Cisco Catalyst SD-WAN Manger: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability (CISA due 2026-04-23) - [CVE-2025-48700](https://erroneo.us/security/cve/CVE-2025-48700/index.md) Synacor Zimbra Collaboration Suite (ZCS): Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CISA due 2026-04-23) - [CVE-2025-32975](https://erroneo.us/security/cve/CVE-2025-32975/index.md) Quest KACE Systems Management Appliance (SMA): Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability (CISA due 2026-05-04) - [CVE-2025-2749](https://erroneo.us/security/cve/CVE-2025-2749/index.md) Kentico Kentico Xperience: Kentico Xperience Path Traversal Vulnerability (CISA due 2026-05-04) - [CVE-2024-27199](https://erroneo.us/security/cve/CVE-2024-27199/index.md) JetBrains TeamCity: JetBrains TeamCity Relative Path Traversal Vulnerability (CISA due 2026-05-04) - [CVE-2023-27351](https://erroneo.us/security/cve/CVE-2023-27351/index.md) PaperCut NG/MF: PaperCut NG/MF Improper Authentication Vulnerability (CISA due 2026-05-04) ## Critical advisories - [CVE-2026-33557](https://erroneo.us/security/cve/CVE-2026-33557/index.md) Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation — Maven org.apache.kafka:kafka-clients >= 4.1.0, < 4.1.2 → 4.1.2 --- Source page: https://erroneo.us/security/2026-04-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt