Week of March 16, 2026: Stryker Cyberattack Alert and a Wave of KEV Additions

Security leaders tracked CISA's hardening alert tied to the March 11, 2026 cyberattack on medical technology firm Stryker Corporation, a wave of nine Known Exploited Vulnerabilities Catalog additions spanning Apple, Cisco, Microsoft, Craft CMS, and Laravel Livewire products, and a joint CISA-FBI warning about Russian Intelligence Services phishing campaigns against messaging app users. The week also brought a material ransomware disclosure from Trio-Tech International and a CISO transition at American Express, where Gleb Reznik succeeded Fred Gibbins.

CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog on March 20, 2026, citing evidence of active exploitation. The additions covered multiple Apple products, Craft CMS, and Laravel Livewire, including buffer overflow, improper locking, and code injection flaws identified as CVE-2025-31277, CVE-2025-32432, CVE-2025-43510, CVE-2025-43520, and CVE-2025-54068. Federal civilian agencies were required to remediate the vulnerabilities under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching them as part of ongoing vulnerability management practices. (CISA)

CISA and FBI Warn of Russian Campaign Against Messaging App Accounts

CISA and the FBI issued a public service announcement on March 20, 2026, warning that cyber actors linked to Russian Intelligence Services were running phishing campaigns against users of commercial messaging applications. Targets included current and former U.S. government officials, military personnel, political figures, and journalists. The agencies said the campaigns compromised individual accounts rather than breaking the applications' underlying encryption, granting access to victims' messages and contact lists and enabling further phishing against other users. CISA and the FBI urged messaging app users to review the advisory and watch for suspicious activity. (CISA)

CISA Urges Endpoint Management Hardening After Stryker Cyberattack

CISA issued an alert on March 18, 2026 urging organizations to harden endpoint management configurations after a cyberattack against medical technology firm Stryker Corporation on March 11, 2026 affected its Microsoft environment. CISA said it was coordinating with the FBI to identify additional threats tied to the activity. The agency pointed organizations to Microsoft's newly released best practices for securing Intune, including least-privilege administrative roles, phishing-resistant multi-factor authentication, and multi-admin approval policies for sensitive changes such as device wipes. (CISA)

CISA Adds Cisco Firewall Management Flaw to KEV Catalog

CISA added a Cisco vulnerability to its Known Exploited Vulnerabilities Catalog on March 19, 2026 based on evidence of active exploitation. The flaw, CVE-2026-20131, affects Cisco Secure Firewall Management Center software and Cisco Security Cloud Control firewall management and involves deserialization of untrusted data. CISA said this type of vulnerability is a frequent attack vector for malicious cyber actors and again urged all organizations, not just federal civilian agencies bound by BOD 22-01, to prioritize remediation as part of their vulnerability management practices. (CISA)

Trio-Tech Discloses Material Ransomware Incident at Singapore Subsidiary

Trio-Tech International disclosed in a Form 8-K filed March 20, 2026 that a ransomware incident at a Singapore subsidiary, first identified March 11, 2026, escalated on March 18, 2026 to include unauthorized disclosure of company data. The subsidiary took its network offline, engaged third-party cybersecurity professionals, notified Singapore law enforcement, and began notifying affected parties. Trio-Tech said the scope of affected data was not yet fully determined and that the incident had not caused material disruption to operations as of the filing date. (SEC EDGAR)

American Express Names Gleb Reznik as CISO

SecurityWeek reported that American Express named Gleb Reznik as Chief Information Security Officer, succeeding Fred Gibbins, in its Industry Moves roundup for the week of March 16, 2026. Reznik joined American Express in August 2024 as SVP, Technology Risk and Information Security, and previously held security leadership roles at JPMorgan, Synchrony, and Capital One. The same roundup noted additional CISO appointments that week, including John Visneski at Green Impact Exchange and Alfredo Hickman at agentic AI security platform Kai. (SecurityWeek)

CISA Adds Microsoft SharePoint Flaw to KEV Catalog

CISA added a Microsoft SharePoint flaw to its Known Exploited Vulnerabilities Catalog on March 18, 2026 based on evidence of active exploitation. The vulnerability, CVE-2026-20963, involves deserialization of untrusted data in SharePoint. CISA again flagged the vulnerability type as a frequent attack vector for malicious actors and said Federal Civilian Executive Branch agencies must remediate it under Binding Operational Directive 22-01, while urging all other organizations to prioritize the fix as part of standard vulnerability management. (CISA)