Week of April 20, 2026: FIRESTARTER Backdoor Hits Cisco Firewalls, Axios npm Supply Chain Hit

Security leaders watched CISA and the UK's NCSC jointly warn of the FIRESTARTER backdoor on Cisco firewalls and release a China-nexus covert network advisory, while a compromise of the Axios npm package forced emergency dependency reviews across development pipelines. The week also brought thirteen new entries to CISA's Known Exploited Vulnerabilities Catalog across three separate updates and a round of senior security leadership appointments.

CISA Adds Eight Vulnerabilities to KEV Catalog

On April 20, 2026, CISA added eight vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The additions included flaws in PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance, and Synacor Zimbra Collaboration Suite, along with three separate Cisco Catalyst SD-WAN Manager vulnerabilities covering privileged API misuse, recoverable password storage, and exposure of sensitive information. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the listed CVEs by assigned deadlines, while CISA urged other organizations to prioritize patching these actively exploited products. (CISA)

Axios npm Package Compromised with Remote Access Trojan Payload

CISA issued an alert on April 20, 2026 describing a software supply chain compromise affecting the widely used Axios npm package. Versions axios@1.14.1 and axios@0.30.4, published March 31, 2026, injected a malicious dependency, plain-crypto-js@4.2.1, that pulled in multi-stage payloads, including a remote access trojan, from threat actor infrastructure. CISA recommended organizations search repositories and CI/CD pipelines for the compromised versions, downgrade to axios@1.14.0 or axios@0.30.3, delete the malicious dependency, rotate exposed credentials such as VCS tokens and cloud keys, and block outbound connections to the associated command-and-control domain. (CISA)

CISA Adds Microsoft Defender Flaw to KEV Catalog

CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog on April 22, 2026: CVE-2026-33825, a Microsoft Defender vulnerability involving insufficient granularity of access control. The agency cited evidence of active exploitation and reminded Federal Civilian Executive Branch agencies that Binding Operational Directive 22-01 requires remediation of catalog entries by set deadlines. CISA again encouraged organizations outside the federal government to treat KEV Catalog entries as a priority within broader vulnerability management programs to reduce exposure to ongoing exploitation activity. (CISA)

CISA and NCSC-UK Detail FIRESTARTER Backdoor on Cisco Firewalls

CISA published a malware analysis report on April 23, 2026 describing FIRESTARTER, a backdoor that advanced persistent threat actors used to maintain persistence on Cisco Firepower and Secure Firewall devices running ASA or Firepower Threat Defense software. Co-sealed with the UK's National Cyber Security Centre, the report tied initial access to exploitation of CVE-2025-20333 and CVE-2025-20362, noting that firmware patches alone did not remove the backdoor from previously compromised devices. CISA updated Emergency Directive 25-03 with new required actions for federal agencies, and Acting Director Nick Andersen said "FIRESTARTER can persist as an active threat" on affected devices. (CISA)

CISA, NCSC-UK and Global Partners Warn of China-Nexus Covert Networks

On April 23, 2026, CISA and the UK's National Cyber Security Centre, joined by partners from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain, and Sweden, released an advisory on China-nexus covert networks. The document described how threat actors including Volt Typhoon and Flax Typhoon route malicious activity through large, externally provisioned networks of compromised small office and home office routers and IoT devices rather than dedicated infrastructure. The advisory recommended organizations map network edge devices, baseline normal VPN connections, maintain log retention, and implement multifactor authentication for remote access. (CISA)

CISA Adds Four More Vulnerabilities to KEV Catalog

CISA added four more vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 24, 2026, citing evidence of active exploitation. The additions covered a Samsung MagicINFO 9 Server path traversal flaw, two SimpleHelp vulnerabilities involving missing authorization and path traversal, and a D-Link DIR-823X command injection vulnerability. As with earlier additions that week, Binding Operational Directive 22-01 set remediation deadlines for Federal Civilian Executive Branch agencies, and CISA again urged other organizations to treat the newly listed CVEs as priorities for patching given their history of exploitation. (CISA)

Security Leadership Moves at Point Wild, Oasis Security, Claroty

SecurityWeek's People on the Move column for the week of April 20, 2026 tracked several security leadership changes. Neil Feather was appointed CEO of Point Wild, succeeding Hari Ravichandran, who moved to board chairman. Identity management company Oasis Security named Michael DeCesare president following a $120 million Series B raise the prior month. Endpoint platform IGEL named Sterling Wilson Global Field CTO for Business Continuity and Disaster Recovery, Claroty appointed John Ryan VP of Worldwide Partner Ecosystem, and Cyber A.I. Group named Irving Bruckstein as CEO. (SecurityWeek)