Weekly briefing

Week 17 · 20 Apr – 26 Apr 2026 UTC · assess the changes, then plan the next dates.

What to assess first

20 Apr – 26 Apr · dates to 26 May Check coverage

Act on1

20Apr
Security20 Apr 2026
Cisco · 3 security records
CVE-2026-20122
Related evidence (4)
- Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
  Public source · Same source page; the statements may concern different changes
- Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
  Public source · Same source page; the statements may concern different changes
- Cisco SD-WAN Path Traversal Vulnerability
  Public source · Same source page; the statements may concern different changes
- Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
  Public source · Same source page; the statements may concern different changes

Coming up8

27Apr
CISA KEV deadlineDue 27 Apr 2026
Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
CVE-2012-1854
Same day: CISA KEV deadline: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability; CISA KEV deadline: Microsoft Windows Out-of-Bounds Read Vulnerability; CISA KEV deadline: Microsoft Windows Link Following Vulnerability
28Apr
RetirementDue 28 Apr 2026
Retirement: Azure Application Gateway v1
Same day: CISA KEV deadline: Microsoft Office Remote Code Execution; CISA KEV deadline: Microsoft SharePoint Server Improper Input Validation Vulnerability
30Apr
RetirementDue 30 Apr 2026
Retirement: Custom Commands
Same day: Message Center action date: MC1181996: Migration update for Office 365 connectors retirement in Teams – webhook URL support
6May
CISA KEV deadlineDue 6 May 2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
CVE-2026-33825
9May
Message Center action dateDue 9 May 2026
MC1276511: Upcoming retirement of older Microsoft Defender for Endpoint mobile app versions (iOS and Android)Microsoft 365 Message Center Archive by Merill Fernando
12May
Patch TuesdayScheduled for 12 May 2026
Patch Tuesday, 12 May 2026
The second Tuesday of the month, when Microsoft releases security updates for Windows, Office, and servers.
12May
End of servicingDue 12 May 2026
End of servicing: .NET 9
Same day: CISA KEV deadline: Microsoft Windows Protection Mechanism Failure Vulnerability
15May
Message Center action dateDue 15 May 2026
MC1282308: Message center post structure updates may require admin script changesMicrosoft 365 Message Center Archive by Merill Fernando

Changed3

22Apr
Security22 Apr 2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
CVE-2026-33825
21Apr
Security21 Apr 2026
WAF - WAF Release - 2026-04-21
Cloudflare WAF changelog
23Apr
Revised23 Apr 2026
MC1216263: Microsoft Teams: Browser selection for links in Teams MobileMicrosoft 365 Message Center Archive by Merill Fernando
Microsoft Teams

How this list is chosen

Changes from 20 Apr 2026 – 26 Apr 2026 UTC and dates due up to 26 May 2026. Dates are the source's own, or labelled as the day ChangeIntel observed a change; never inferred effective dates.

Ranked by kind: exploited vulnerabilities, then up to 7 dates, open known issues, and other notable changes, with at most one entry per feed. Service incidents are on the status board; security baseline downloads, first captures of a document, and metadata-only documentation checks are left out. This is a view of retained evidence, not a reconstruction of everything known at the time.

The briefing is selective. Browse every dated change, review upcoming dates or check the period's coverage.