CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access ExploitsCISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
In May 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-20182, affecting Cisco Catalyst SD-WAN Controllers and Managers, to its Known Exploited Vulnerabilities (KEV) catalog. This authentication bypass flaw allows unauthenticated remote attackers to gain administrative privileges on affected systems. Exploitation has been linked to the threat actor cluster UAT-8616, which has previously targeted similar vulnerabilities to gain unauthorized access to SD-WAN systems. The attackers have been observed adding SSH keys, modifying NETCONF configurations, and escalating privileges to root. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-cisco-sd-wan-cve-2026-20182.html?utm_source=openai))
The inclusion of CVE-2026-20182 in the KEV catalog underscores the ongoing threat posed by sophisticated actors targeting critical infrastructure. Organizations utilizing Cisco SD-WAN solutions must prioritize patching and implementing recommended mitigations to prevent potential breaches and maintain network security.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Critical XSS Vulnerability CVE-2026-42897 Exploited in Microsoft Exchange Server
In May 2026, Microsoft disclosed a critical cross-site scripting (XSS) vulnerability, CVE-2026-42897, affecting on-premises versions of Exchange Server 2016, 2019, and Subscription Edition. This flaw allows unauthorized attackers to perform spoofing attacks over a network by sending specially crafted emails. When such an email is opened in Outlook Web Access (OWA) under certain conditions, arbitrary JavaScript can be executed in the user's browser context. Microsoft confirmed active exploitation of this vulnerability in the wild, prompting immediate mitigation measures. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/?utm_source=openai))
The urgency of addressing CVE-2026-42897 is heightened by its active exploitation and the widespread use of affected Exchange Server versions. Organizations relying on on-premises email infrastructure are at significant risk, necessitating prompt application of Microsoft's recommended mitigations to prevent potential data breaches and maintain operational integrity. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4519822?utm_source=openai))
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security
In May 2026, cybersecurity researchers identified four critical vulnerabilities in OpenClaw, an AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—enable attackers to bypass sandbox restrictions, escalate privileges, and establish persistent control over affected systems. Exploitation could lead to unauthorized data access, system configuration tampering, and the planting of backdoors, significantly compromising system integrity and security.
The discovery of these vulnerabilities underscores the urgent need for robust security measures in AI agent frameworks. As AI systems become more integrated into critical operations, ensuring their security is paramount to prevent potential exploitation by malicious actors.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot
In June 2025, security researchers discovered 'EchoLeak' (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. This flaw allowed attackers to exfiltrate sensitive enterprise data, including chat logs, OneDrive files, SharePoint content, and Teams messages, without any user interaction. The attack was initiated through a crafted email that, when processed by Copilot, triggered unauthorized data access and transmission. Microsoft promptly addressed the vulnerability upon disclosure, mitigating potential exploitation. ([techrepublic.com](https://www.techrepublic.com/article/news-microsoft-365-copilot-flaw-echoleak/?utm_source=openai))
The EchoLeak incident underscores the critical need for robust security measures in AI-integrated systems. As AI becomes more embedded in enterprise environments, ensuring comprehensive logging, visibility, and compliance with emerging regulations like the EU AI Act's traceability requirements is paramount to prevent similar vulnerabilities.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Cisco SD-WAN Zero-Day CVE-2026-20182 Exploited by UAT-8616
In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager platforms. This flaw allows unauthenticated remote attackers to gain administrative access by exploiting weaknesses in the peering authentication mechanism. The threat group UAT-8616 has been actively exploiting this vulnerability, leading to unauthorized control over affected systems. Cisco has released patches to address this issue and urges immediate application to prevent further exploitation.
This incident underscores the persistent targeting of network infrastructure by advanced threat actors. Organizations must prioritize timely patch management and enhance monitoring to detect and mitigate such sophisticated attacks.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability
In May 2026, a critical vulnerability known as Fragnesia (CVE-2026-46300) was discovered in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files. Security researcher William Bowling identified this issue and released a proof-of-concept exploit demonstrating its potential impact. The vulnerability affects all Linux kernels released before May 13, 2026, and is part of the broader 'Dirty Frag' class of vulnerabilities.
The disclosure of Fragnesia underscores the ongoing challenges in securing the Linux kernel against privilege escalation attacks. With public exploits available and patches being rolled out, organizations must prioritize updating their systems to mitigate potential threats. This incident highlights the importance of proactive vulnerability management and the need for continuous monitoring of emerging security flaws.
High impact
Kill Chain
ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware
In April 2026, the threat actor KongTuke initiated a campaign leveraging Microsoft Teams to impersonate internal IT support staff. By contacting employees through external Teams chats, they persuaded victims to execute a malicious PowerShell command, leading to the deployment of ModeloRAT malware. This tactic enabled KongTuke to establish persistent access to corporate networks within minutes, facilitating data exfiltration and potential ransomware attacks.
This incident underscores a significant shift in cybercriminal strategies, highlighting the exploitation of trusted communication platforms for social engineering. The rapid execution and effectiveness of this method emphasize the need for organizations to reassess and strengthen their security protocols, particularly concerning collaboration tools.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Cisco CVE-2026-20182: Critical SD-WAN Zero-Day Exploited in the Wild
In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager, which was actively exploited in zero-day attacks. This flaw allowed unauthenticated remote attackers to gain administrative privileges by sending crafted requests, potentially enabling them to manipulate network configurations and insert rogue devices into the SD-WAN fabric. The vulnerability affected both on-premises and cloud deployments, posing significant risks to organizations relying on Cisco's SD-WAN solutions.
The discovery of CVE-2026-20182 underscores the persistent targeting of network infrastructure by sophisticated threat actors. This incident highlights the critical need for organizations to promptly apply security patches, monitor for unauthorized access, and implement robust network segmentation to mitigate the impact of such vulnerabilities.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection
In May 2026, multiple critical cybersecurity incidents emerged, notably the exploitation of a buffer overflow vulnerability (CVE-2026-0300) in Palo Alto Networks' PAN-OS User-ID Authentication Portal, allowing unauthenticated attackers to execute arbitrary code with root privileges. Additionally, Anthropic's AI model, Mythos, identified a low-severity vulnerability in the widely-used cURL tool, sparking debates about the efficacy of AI in vulnerability detection. These incidents underscore the persistent challenges in securing network infrastructure and the evolving role of AI in cybersecurity. The active exploitation of the PAN-OS vulnerability highlights the urgency for organizations to apply patches promptly and reassess their exposure to untrusted networks. Simultaneously, the discourse surrounding Mythos's findings emphasizes the need for a balanced approach to integrating AI tools in security workflows, ensuring they complement human expertise without overreliance.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Malicious 'node-ipc' Versions Compromise Developer Credentials
On May 14, 2026, malicious versions of the widely used npm package 'node-ipc' were published, specifically versions 9.1.6, 9.2.3, and 12.0.1. These versions contained obfuscated backdoor code designed to steal developer credentials, including cloud service keys, SSH keys, and other sensitive information. The malware executed upon requiring the package, exfiltrating data to an attacker-controlled server. The compromised versions were published by an unauthorized account, indicating a potential maintainer account takeover. ([thehackernews.com](https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html?utm_source=openai))
This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises. The event highlights the necessity for continuous monitoring and verification of third-party dependencies to safeguard against unauthorized code injections.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Controller (CVE-2026-20182)
In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager, formerly known as vSmart and vManage. This flaw allows unauthenticated, remote attackers to gain administrative privileges by exploiting weaknesses in the peering authentication mechanism. Successful exploitation enables attackers to access NETCONF, facilitating unauthorized manipulation of network configurations. Cisco has released software updates to address this issue, emphasizing the absence of viable workarounds. Organizations are urged to apply these patches promptly to mitigate potential risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW?utm_source=openai))
The exploitation of CVE-2026-20182 underscores a concerning trend of attackers targeting critical network infrastructure components. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to monitor for unauthorized access attempts. The ongoing exploitation of such vulnerabilities emphasizes the importance of proactive security measures to protect against evolving threats. ([news.backbox.org](https://news.backbox.org/2026/05/14/ongoing-exploitation-of-cisco-catalyst-sd-wan-vulnerabilities/?utm_source=openai))
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Understanding the Risks: AI Integration and Cloud Security
In 2025, the enterprise risk landscape experienced a paradigm shift: the adoption of AI and LLMs officially becoming the primary driver of cloud risk. Today, almost 88% of organizations now leverage AI in at least one business function. With this level of integration, the risk of AI is now outpacing traditional security guardrails, culminating in a highly complex and interconnected attack surface. SentinelOne’s new AI and Cloud Verified Exploit Paths and Secrets Scanning Report examines this evolving threatscape and draws on telemetry from over 11,000 anonymized customer environments to offer deeper visibility into how threat actors are actively exploiting modern cloud and AI infrastructures. A primary finding of the 2026 report is the rising proliferation of AI-specific credentials. The data indicates that AI-related secrets — such as OpenAI API Keys, Azure OpenAI API Keys, and others — increased by approximately 140% in a span of one year. This growth correlates directly with the rapid embedding of AI technologies into customer support systems, internal tooling, financial platforms, and product experiences. Ubiquitous deployment has generated a widespread organizational pattern known as 'shadow AI' – the unsanctioned use of AI tools in an environment without formal IT approval or security oversight. In practice, this occurs when developers or internal teams utilize unmanaged or personal LLM keys to process corporate data outside of sanctioned IT or security channels. Since these AI integrations span numerous internal applications, the same API keys are frequently duplicated and stored within code repositories, SaaS configurations, and development scripts. Compounding this, these credentials are often implemented without proper access controls or routine rotation schedules. The sprawl of these credentials renders them difficult to track via standard secrets management protocols, establishing a requirement for more centralized governance over how AI keys are issued and utilized.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
