CISA Adds SimpleHelp, Samsung MagicINFO, and End-of-Life D-Link Flaws to KEV Catalog as DragonForce Ransomware and Mirai Botnets Exploit Them in the Wild
CISA's April 24 KEV update flags four actively exploited vulnerabilities tied to ransomware against managed service providers and Mirai DDoS botnets, with a May 8 federal patching deadline.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its Known Exploited Vulnerabilities catalog on April 24, 2026, citing confirmed in-the-wild exploitation across remote management software, digital signage servers, and discontinued consumer routers. The additions cover two SimpleHelp flaws being chained by the DragonForce ransomware operation, a Samsung MagicINFO 9 path-traversal bug, and a command-injection vulnerability in end-of-life D-Link DIR-823X routers that is now feeding a fresh Mirai botnet campaign. Federal Civilian Executive Branch agencies have until May 8, 2026 to patch or stop using the affected products, according to CISA’s alert.
What CISA Added
The four entries on the KEV catalog are CVE-2024-57726 and CVE-2024-57728 in SimpleHelp’s remote monitoring and management software, CVE-2024-7399 in Samsung MagicINFO 9 Server, and CVE-2025-29635 in D-Link DIR-823X series routers. All four were added under Binding Operational Directive 22-01, which obligates federal agencies to remediate KEV entries within set deadlines or, for unsupported products, to remove them from service.
The SimpleHelp pair is the most consequential for enterprise environments. CVE-2024-57726 is a missing-authorization flaw in SimpleHelp 5.5.7 and earlier that, per the National Vulnerability Database, “allows low-privileges technicians to create API keys with excessive permissions.” The CVSS v3.1 base score is 9.9. The companion bug, CVE-2024-57728, is a path-traversal (“zip slip”) flaw rated 7.2 that lets an admin user upload arbitrary files anywhere on the host file system, leading to remote code execution. Chained together, the two flaws turn a low-privileged technician account into root-level control over the SimpleHelp server and, by extension, every endpoint that server manages.
The Samsung issue, CVE-2024-7399, is a path-traversal vulnerability in MagicINFO 9 Server versions before 21.1050. NVD scores it 9.8 critical, treating it as exploitable without authentication; Samsung’s own assessment is 8.8 high and assumes a logged-in attacker.
CVE-2025-29635 is a command-injection vulnerability in D-Link DIR-823X firmware versions 240126 and 240802. The NVD entry describes it as a flaw that “allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting,” with a CVSS v3.1 score of 7.2.
DragonForce and the SimpleHelp Chain
The SimpleHelp flaws were originally disclosed in January 2025, and security vendors have spent more than a year tracking how ransomware crews monetized them. The Hacker News reports that early observations from Field Effect and Sophos linked the bugs to ransomware deployments, with one campaign attributed to the DragonForce operation. The attack pattern is the kind that scares managed service providers most: SimpleHelp is an MSP-favored remote management tool, so a single compromised SimpleHelp server lets attackers push payloads simultaneously to every customer environment under that MSP’s care.
CISA’s KEV entry treats the SimpleHelp bugs as actively exploited but, according to The Hacker News, the catalog still marks ransomware use as “Unknown” for both CVEs. That metadata gap reflects CISA’s evidentiary threshold rather than uncertainty about DragonForce’s involvement, which has been documented in multiple vendor reports cited by the agency.
The published fix is SimpleHelp 5.5.8 or later. Servers that have not been upgraded by May 8 will put federal civilian agencies in violation of BOD 22-01 and leave private operators exposed to a chain that has been weaponized at scale for more than a year.
Mirai Returns Through a Discontinued D-Link Line
The D-Link entry lands differently because the affected hardware is dead. BleepingComputer reports that the DIR-823X reached end-of-life in November 2024, meaning D-Link is not expected to issue a firmware patch even though active exploitation is now confirmed. CISA’s KEV-mandated mitigation language acknowledges this directly by allowing agencies to “discontinue use of the appliance” as an alternative to patching.
Akamai’s Security Intelligence Response Team detected the first wave of in-the-wild attacks in early March 2026, more than a year after the underlying vulnerability was publicly disclosed. Per BleepingComputer, the attackers drop a shell script named dlink.sh that pulls down a Mirai variant called “tuxnokill,” supporting multiple CPU architectures and conscripting compromised routers into a botnet capable of TCP SYN, ACK, STOMP, UDP-flood, and HTTP-null DDoS attacks. The pattern fits a long-running pathology of consumer networking gear: a vulnerability is disclosed, the vendor declines to patch, and a Mirai operator eventually adds the device to its target list.
Samsung MagicINFO and the Industrial Signage Surface
MagicINFO 9 Server is Samsung’s content management platform for digital signage networks, most often deployed in retail, hospitality, transit, and public-sector environments. The path-traversal flaw lets an attacker write files to arbitrary locations as the system user, which on a typical signage server means full compromise. The Hacker News notes that exploitation of CVE-2024-7399 has also been linked to Mirai-family botnet deployment, expanding the same playbook from end-of-life consumer routers to actively supported enterprise software.
Samsung issued a fixed build, MagicINFO 9 Server 21.1050, but as the NVD entry makes clear, the discrepancy between Samsung’s CVSS 8.8 assessment and NIST’s CVSS 9.8 reflects an unresolved disagreement about whether attackers need authentication. NIST’s stricter rating treats the bug as remotely exploitable with no privileges required.
What We Don’t Know
CISA’s alert does not name specific federal agencies or private organizations affected by any of the four bugs, nor does it disclose the specific intelligence that triggered each addition. The agency’s KEV catalog is also silent on the volume of ongoing exploitation: the entries confirm that exploitation is happening but do not quantify it. For the SimpleHelp pair, third-party vendor reports remain the most detailed public source of attribution to DragonForce; CISA itself stops short of naming the ransomware crew in its KEV metadata.
For the D-Link bug, the population of vulnerable devices is not directly enumerable. The DIR-823X line’s installed base is unknown, and because the hardware is discontinued, no patch telemetry will surface to indicate how many of those routers remain online and reachable from the open internet.
The May 8 deadline binds federal civilian agencies, but private-sector compliance is voluntary. KEV inclusion historically drives a wave of insurer pressure, scanner updates, and customer questions, though the actual patching curve for SimpleHelp servers and MagicINFO deployments will likely lag the federal date by weeks or months.
Analysis
The April 24 update reads as a snapshot of three different exploitation economies operating at the same time. SimpleHelp represents the ransomware-as-a-service supply chain, where an MSP-targeting RCE chain becomes a force multiplier for crews like DragonForce. Samsung MagicINFO sits in the enterprise-software middle, where a path-traversal bug in deployed-everywhere signage software gets quietly absorbed into Mirai-family campaigns. The D-Link entry is the IoT residue layer: a vulnerability whose vendor has formally walked away, leaving CISA to recommend physical decommissioning as the only durable response.
The shared thread is that all four CVEs were known long before the KEV listing. CVE-2024-57726 dates to January 2025, CVE-2024-7399 and CVE-2025-29635 to 2024 and early 2025 respectively. The lag between disclosure and KEV escalation underscores how the catalog functions less as an early warning system than as a forcing function: by the time CISA elevates a CVE to KEV status, exploitation is already routine. The May 8 deadline is short enough to push remediation but long enough to acknowledge that operators of remote management software and signage servers will need a maintenance window to patch.