TL;DR
Last updated: 2026-04-10
This recap covers the period from March 1, 2026 to April 10, 2026. It is a curated list of developments that matter most for security leaders, IT teams, and GRC owners. It is not a legal opinion, and final regulatory interpretation should sit with your legal counsel.
This period combined exploitation of widely deployed software, business disruption in healthcare and infrastructure-related environments, and regulatory work on resilience and reporting.
On February 25, CISA issued ED 26-03 for Cisco SD-WAN systems, and the deadlines ran into March. The directive said the activity presented an imminent threat to federal networks, while Cisco’s advisory described a critical authentication bypass in Catalyst SD-WAN Controller and Manager that could allow administrative access. Even if you are not a federal agency, the signal is clear: identity and control-plane weaknesses in edge infrastructure remain a high-priority attacker path.
Why it matters for GRC: patch SLAs, asset inventory quality, and exception tracking are now board-level questions when the weakness sits in internet-facing control infrastructure.
Google disclosed active exploitation of Chrome zero-days multiple times in March and again at the end of March. On March 12 and March 13, Google said exploits for CVE-2026-3910 and CVE-2026-3909 existed in the wild, and on March 31 Google disclosed active exploitation for CVE-2026-5281. BleepingComputer also reported on April 1 that Google had fixed its fourth actively exploited Chrome zero-day of 2026.
Why it matters for GRC: include browsers in emergency patch procedures and verify that updates are installed.
Citrix published a March 27 security bulletin for CVE-2026-3055, and CISA’s Known Exploited Vulnerabilities catalog lists that issue as actively exploited. Reporting around the disclosure said the flaw affected NetScaler ADC and Gateway appliances and could expose sensitive data such as session tokens.
Why it matters for GRC: maintain an inventory of externally reachable systems, assign owners and verify remediation.
On April 9, multiple reports said attackers had been exploiting an Adobe Reader zero-day via malicious PDFs since at least December 2025. The reported behavior is especially notable because PDFs remain one of the most normal-looking delivery mechanisms in business environments.
Why it matters for GRC: document handling requires secure email, endpoint policies, sandboxing and staff training to address malicious attachments.
The European Commission disclosed a cyberattack on March 27 affecting the cloud infrastructure behind the Europa web platform. On April 2, CERT-EU said with high confidence that the initial access vector was the Trivy supply-chain compromise, and described compromise of AWS access connected to that environment. CERT-EU’s later analysis tied the incident to a broader third-party trust problem, not just a single misconfiguration.
Why it matters for GRC: supplier reviews should cover package integrity, CI/CD access, key management and developer tooling.
Stryker disclosed on March 11 that a cyberattack caused a global disruption to its Microsoft environment. Reuters later reported that the incident affected order processing, manufacturing, and shipments, and that manufacturing was mostly restored only later in March. Separate reporting said some surgeries were delayed.
Why it matters for GRC: define procurement, operations, legal and communications roles for incidents that interrupt manufacturing and fulfillment.
On March 16, the Council of the EU announced sanctions against three entities and two individuals responsible for cyberattacks against EU member states and partners. Reuters separately reported that the listed entities included two China-based companies and one Iranian company.
Why it matters for GRC: attribution is still messy, but enforcement tools are broadening. Sanctions exposure, vendor screening, and geopolitical cyber risk are moving closer together.
On March 18, the FCA confirmed new rules to make operational incident and third-party reporting clearer and more consistent. The FCA’s policy materials say the rules come into force on March 18, 2027, giving firms a 12-month preparation window, while Reuters noted that more than 40% of cyber incidents reported to the FCA in 2025 involved a third party.
Why it matters for GRC: third-party incidents can trigger reporting and supervisory obligations.
On March 3, the European Commission published draft guidance to help companies apply the Cyber Resilience Act. The Commission’s implementation page also points to September 11, 2026 as the date when certain reporting obligations enter into application.
Why it matters for GRC: product security teams, software vendors, and importers should stop treating the CRA as “future work.” The implementation phase is where ownership, evidence collection, and documentation models need to become real.
On April 7, U.S. agencies including CISA, FBI, NSA, EPA, DOE, and U.S. Cyber Command issued a joint advisory on Iranian-affiliated cyber actors exploiting programmable logic controllers across U.S. critical infrastructure. The advisory said the activity had already led to disruptions and targeted PLC devices used across sectors including water and energy.
Why it matters for GRC: OT and critical-systems exposure can no longer be left outside enterprise governance. Asset visibility, remote access policy, segmentation, and vendor support arrangements are now core governance questions.
Use this as a quick leadership and operations review for the coming week:
Review exploit exposure, supplier access and recovery testing. Check whether the asset inventory, remediation priorities and fallback procedures reflect the systems actually in use.
Translate these stories into evidence requests. Ask for current internet-facing asset inventories, emergency patch records, third-party dependency maps, and incident escalation criteria. Record missing evidence and assign responsibility for completing it.
They were chosen based on a mix of operational impact, regulatory significance, and broad relevance for enterprise security and GRC teams between March 1, 2026 and April 10, 2026. Ongoing investigations may change some incident details.
Yes, especially if you rely on international SaaS, cloud platforms, external vendors, browser-based workflows, or serve EU and UK customers. The technical risk is global, and some of the regulatory shifts can influence client expectations even when they do not directly apply by law.
Partly. The FCA reporting rules, CRA implementation guidance, and EU sanctions are governance and regulatory developments. Final legal interpretation should sit with counsel.
Include coordination and decision-making in resilience planning. The common failure points in this recap were exposure visibility, supplier trust, response speed, and cross-functional decision-making.
If your team wants a practical way to turn these headlines into an action plan, start with a focused review of your incident reporting process, supplier risk controls, and patch governance.
