CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-15T19:24:09Z•2c4b6909add332fa2e06a51eadd908cc025ef49fac96c938de49da6352d1fdd8
BOD 22-01BerriAICISACisco SD‑WANIvanti EPMMKEV CatalogLinux kernelMicrosoft ExchangePalo Alto PAN‑OSSQL injectionXSSactive exploitationauthentication bypasscPanelimproper input validationknown exploited vulnerabilitymissing authenticationout‑of‑bounds writevulnerability management
What happened
Between 1–15 May 2026, CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and urged remediation under Binding Operational Directive (BOD) 22-01. Newly listed CVEs affect Microsoft Exchange (cross-site scripting), Cisco Catalyst SD‑WAN Controller (authentication bypass), BerriAI LiteLLM (SQL injection), Ivanti Endpoint Manager Mobile (improper input validation), Palo Alto PAN‑OS (out‑of‑bounds write), Linux kernel (incorrect resource transfer), and WebPros cPanel & WHM / WP2 (missing authentication). CISA recommends prioritized remediation/hardening per KEV
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 2c4b6909add332fa2e06a51eadd908cc025ef49fac96c938de49da6352d1fdd8
- Enrichment time
- 2026-05-15T19:24:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.