CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-26T19:24:16Z•34cb228bb5fc5d9c20178d67a567c35f399a344fbd5d8282a7ffb16fecaebc7f
active-exploitationadobeauthentication-bypassberriaibinding-operational-directive-bod-22-01cisaciscocross-site-scriptingdenial-of-servicedirectory-traversaldrupalelevation-of-privilegekev-catalogknown-exploited-vulnerabilitieslangflowlitespeedmicrosoftpatchingprivilege-escalationsql-injectiontrend-microvulnerability-management
What happened
In May 2026 CISA added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The additions span multiple vendors and vulnerability types (SQL injection, privilege escalation, authentication bypass, directory traversal, XSS, DoS, elevation of privilege), and CISA reiterates BOD 22-01 remediation requirements for Federal Civilian Executive Branch agencies and urges all organizations to prioritize timely remediation.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 34cb228bb5fc5d9c20178d67a567c35f399a344fbd5d8282a7ffb16fecaebc7f
- Enrichment time
- 2026-05-26T19:24:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.