Microsoft Defender Zero-Day and 17-Year-Old Excel RCE (CVE-2009-0238) Both Hit KEV

This THN bulletin aggregates multiple distinct threat vectors, the most analytically striking of which is CVE-2009-0238 — a Microsoft Office Excel RCE from 2009 now confirmed in KEV with a due date of April 28, 2026, and an EPSS of 0.57, indicating active exploitation at material scale. The Defender zero-day (likely CVE-2026-26151 or CVE-2026-33825, both unpopulated in CVE intel — consistent with very recent assignment) warrants direct review of the bulletin, as a bypass of the primary endpoint protection layer is a force-multiplier for any concurrent campaign. SonicWall brute-force activity rounds out the edge-device exposure picture. The actor breadth — APT29, APT41, LockBit, Qilin, UNC1069, UNC2465, Evilnum, Hunters International — reflects the roundup format rather than a single coordinated campaign, but each thread carries independent operational weight.

CVE-2009-0238 entering KEV in 2026 is the sleeper signal here: a 17-year-old Excel parsing bug with EPSS approaching 0.58 implies a threat actor is actively working the document-delivery vector against organizations still ingesting untrusted Office files — which describes most of the enterprise. The Defender zero-day is the more acute concern operationally, but without populated CVE intel for the 2026 CVEs, severity and patch status require direct bulletin review. Qilin's listing here is consistent with their appearance in the automotive ransomware report (story 5233).

CVE-2009-0238 reaching KEV in 2026 with EPSS approaching 0.58 is the second data point in two days for yesterday's NVD/scoring-mismatch editorial — Thursday's observation that ancient Excel bugs are quietly being operationalized didn't have to wait long for confirmation. The Defender bypass is the acute operational item and warrants direct bulletin review given the CVE intel gap; the roundup format here carries more weight than usual because the underlying signal is coherent.