CVE Alerts: Critical Zero-Days Target Windows, Adobe, SAP Systems

Cybersecurity agencies issued urgent warnings this week as six new vulnerabilities joined CISA’s Known Exploited Vulnerabilities catalog, while critical flaws in SAP ABAP systems and ShowDoc servers face active exploitation campaigns. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added exploited vulnerabilities affecting Fortinet, Microsoft, and Adobe products, with threat actors demonstrating sophisticated attack methodologies targeting enterprise infrastructure.

Meanwhile, SAP released 19 security patches addressing critical vulnerabilities across multiple enterprise products, including a severe ABAP flaw that could compromise entire business systems. Security researchers also identified active exploitation of CVE-2025-0520 in ShowDoc servers, highlighting the persistent threat landscape facing organizations worldwide.

CISA Expands Known Exploited Vulnerabilities Catalog

According to The Hacker News, CISA added six critical security flaws to its KEV catalog, citing evidence of active exploitation in the wild. The most severe vulnerability, CVE-2026-21643, carries a CVSS score of 9.1 and affects Fortinet FortiClient EMS through an SQL injection attack vector.

This SQL injection vulnerability enables unauthenticated attackers to execute arbitrary database queries, potentially exposing sensitive enterprise data and compromising network security. The flaw demonstrates how threat actors exploit input validation weaknesses to bypass authentication mechanisms and gain unauthorized system access.

Additional vulnerabilities target Microsoft Windows and Adobe software, creating multiple attack surfaces for cybercriminals. These flaws allow attackers to escalate privileges and execute remote code, according to SecurityWeek, establishing persistent footholds within compromised networks.

Key Attack Vectors:

• SQL injection bypassing authentication controls
• Privilege escalation through Windows vulnerabilities
• Remote code execution via Adobe product flaws
• Cross-platform exploitation targeting enterprise environments

SAP Addresses Critical ABAP System Vulnerabilities

SAP released comprehensive security updates addressing 19 vulnerabilities across its enterprise product portfolio, with particular focus on critical ABAP system flaws. According to SecurityWeek, these patches target over a dozen enterprise products, highlighting the extensive attack surface present in modern business applications.

The critical ABAP vulnerability represents a significant threat to organizations running SAP enterprise resource planning (ERP) systems. ABAP (Advanced Business Application Programming) serves as the foundation for SAP’s business logic, making vulnerabilities in this layer particularly dangerous for enterprise security.

Threat Assessment:

• Direct access to business-critical data and processes
• Potential for lateral movement across enterprise networks
• Risk of data exfiltration and business disruption
• Compliance violations under data protection regulations

Security teams must prioritize these patches given SAP’s central role in enterprise operations. Delayed patching could expose organizations to supply chain attacks and business process manipulation, creating cascading security incidents across interconnected systems.

ShowDoc RCE Vulnerability Under Active Exploitation

Cybersecurity researchers identified active exploitation campaigns targeting CVE-2025-0520, a critical remote code execution vulnerability in ShowDoc document management systems. The Hacker News reports this flaw carries a CVSS score of 9.4, representing an unrestricted file upload vulnerability stemming from improper input validation.

The vulnerability, also designated as CNVD-2020-26585, enables attackers to upload malicious files and execute arbitrary code on vulnerable servers. ShowDoc’s popularity in Chinese enterprise environments makes this vulnerability particularly concerning for organizations operating in Asia-Pacific regions.

Exploitation Methodology:

• Attackers upload malicious files through vulnerable endpoints
• Improper validation allows execution of arbitrary code
• Remote code execution provides full system compromise
• Lateral movement enables network-wide infiltration

Threat actors demonstrate sophisticated understanding of ShowDoc’s architecture, crafting targeted payloads that bypass existing security controls. Organizations using ShowDoc must implement emergency patching procedures and conduct thorough security assessments to identify potential compromises.

Windows and Adobe Zero-Day Threat Landscape

Microsoft Windows and Adobe Acrobat vulnerabilities represent ongoing challenges in the enterprise security landscape. According to SecurityWeek, these security defects enable attackers to escalate privileges and execute arbitrary code remotely, creating persistent threats to organizational security.

Windows vulnerabilities typically target kernel-level components, allowing attackers to gain SYSTEM-level privileges and disable security controls. Adobe Acrobat flaws often exploit document processing mechanisms, enabling malicious PDF files to execute code when opened by unsuspecting users.

Defense Strategies:

• Implement application sandboxing and containment
• Deploy endpoint detection and response (EDR) solutions
• Establish document security policies and scanning
• Maintain comprehensive patch management programs

These vulnerabilities highlight the importance of defense-in-depth strategies that assume breach scenarios and implement multiple security layers. Organizations must balance operational requirements with security controls to minimize exposure while maintaining business functionality.

Emerging Threat Intelligence and Attack Trends

The Hacker News weekly security recap reveals concerning trends in vulnerability exploitation, including fiber optic infrastructure spying and advanced Windows rootkit deployment. State-sponsored threat actors demonstrate increasing sophistication in targeting critical infrastructure and enterprise systems.

The emergence of AI-powered vulnerability hunting tools enables both security researchers and malicious actors to identify zero-day vulnerabilities more efficiently. This technological advancement accelerates the vulnerability disclosure timeline while simultaneously increasing the risk of exploitation before patches become available.

Threat Evolution Indicators:

• Infrastructure-level targeting by nation-state actors
• AI-enhanced vulnerability discovery and exploitation
• Persistent rootkit deployment in enterprise environments
• Cross-platform attack campaigns targeting multiple vendors

Security teams must adapt their threat models to address these evolving attack methodologies, implementing continuous monitoring and threat hunting capabilities to identify sophisticated intrusion attempts.

What This Means

The current vulnerability landscape demonstrates the critical importance of proactive security management and rapid patch deployment. Organizations face sophisticated threat actors exploiting known vulnerabilities while simultaneously developing zero-day exploits for undisclosed flaws.

CISA’s expanded KEV catalog serves as a crucial threat intelligence resource, providing actionable information about actively exploited vulnerabilities. Security teams must prioritize these known exploited flaws while maintaining comprehensive vulnerability management programs addressing the broader threat landscape.

The convergence of enterprise software vulnerabilities across SAP, Microsoft, Adobe, and specialized applications like ShowDoc highlights the interconnected nature of modern security risks. Organizations must implement holistic security strategies that address multiple attack vectors simultaneously while maintaining operational resilience.

FAQ

What makes CVE-2026-21643 particularly dangerous for enterprises?
This SQL injection vulnerability in Fortinet FortiClient EMS allows unauthenticated attackers to bypass security controls and access sensitive database information, potentially compromising entire enterprise networks through a single exploit.

How quickly should organizations patch the SAP ABAP vulnerabilities?
Given SAP’s central role in business operations and the critical nature of ABAP systems, organizations should implement emergency patching procedures within 72 hours while conducting thorough testing to ensure business continuity.

What immediate steps should ShowDoc users take to protect against CVE-2025-0520?
Organizations should immediately update ShowDoc installations, implement network segmentation to isolate document management systems, and conduct security assessments to identify potential compromises from active exploitation campaigns.