This Week in Threats: May 12–May 26, 2026

Weekly Threat Summary

12 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 10.0.

This week includes 5 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2008-4250 — Microsoft Windows Buffer Overflow Vulnerability

• CVSS Score: 10.0 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-20182 — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

• CVSS Score: 10.0 (CRITICAL)
• Date Added: 2026-05-14
• Description: Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an...
• Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

CVE-2010-0806 — Microsoft Internet Explorer Use-After-Free Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2009-1537 — Microsoft DirectX NULL Byte Overwrite Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-34291 — Langflow Origin Validation Error Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-05-21
• Description: Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-06-03
• Description: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-42897 — Microsoft Exchange Server Cross-Site Scripting Vulnerability

• CVSS Score: 8.1 (HIGH)
• Date Added: 2026-05-15
• Description: Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-41091 — Microsoft Defender Link Following Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-05-20
• Description: Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

• CVSS Score: 6.7 (MEDIUM)
• Date Added: 2026-05-21
• Description: Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-9082 — Drupal Core SQL Injection Vulnerability

• CVSS Score: 6.5 (MEDIUM)
• Date Added: 2026-05-22
• Description: Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-45498 — Microsoft Defender Denial of Service Vulnerability

• CVSS Score: 4.0 (MEDIUM)
• Date Added: 2026-05-20
• Description: Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2008-4250 → D2 Threats & Vulnerabilities
• CVE-2026-20182 → D2 Threats & Vulnerabilities
• CVE-2009-3459 → D2 Threats & Vulnerabilities
• CVE-2026-42897 → D2 Threats & Vulnerabilities
• CVE-2026-9082 → D2 Threats & Vulnerabilities

ISC2 CISSP

• CVE-2008-4250 → D6 Security Assessment
• CVE-2026-20182 → D5 IAM, D6 Security Assessment
• CVE-2010-0806 → D6 Security Assessment
• CVE-2009-3459 → D6 Security Assessment
• CVE-2009-1537 → D6 Security Assessment
• CVE-2025-34291 → D6 Security Assessment
• CVE-2010-0249 → D6 Security Assessment
• CVE-2026-42897 → D6 Security Assessment
• CVE-2026-41091 → D6 Security Assessment
• CVE-2026-34926 → D6 Security Assessment
• CVE-2026-9082 → D6 Security Assessment
• CVE-2026-45498 → D6 Security Assessment

Cisco CCNA

• CVE-2026-42897 → D1 Network Fundamentals

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.