This Week in Threats: May 05–May 19, 2026

Weekly Threat Summary

5 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 10.0.

This week includes 3 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2026-20182 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

• CVSS Score: 10.0 (CRITICAL)
• Date Added: 2026-05-14
• Description: Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an...
• Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CVE-2026-42208 — BerriAI LiteLLM SQL Injection Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-05-08
• Description: BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-0300 — Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-06
• Description: Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required.

CVE-2026-42897 — Microsoft Exchange Server Cross-Site Scripting Vulnerability

• CVSS Score: 8.1 (HIGH)
• Date Added: 2026-05-15
• Description: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-6973 — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

• CVSS Score: 7.2 (HIGH)
• Date Added: 2026-05-07
• Description: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2026-20182 → D2 Threats & Vulnerabilities
• CVE-2026-42208 → D2 Threats & Vulnerabilities, D3 Security Architecture
• CVE-2026-42897 → D2 Threats & Vulnerabilities
• CVE-2026-6973 → D4 Security Operations

ISC2 CISSP

• CVE-2026-20182 → D5 IAM, D6 Security Assessment
• CVE-2026-42208 → D6 Security Assessment
• CVE-2026-0300 → D4 Communication & Network, D5 IAM, D6 Security Assessment
• CVE-2026-42897 → D6 Security Assessment
• CVE-2026-6973 → D6 Security Assessment

Cisco CCNA

• CVE-2026-42897 → D1 Network Fundamentals

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.