CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-14T19:24:10Z•68df26f0dc836431eebf63e6d5caeca5dcd77aff30db3c556b4d3dc9c4d984ba
BOD-22-01CISACisco SD-WANConnectWiseED-26-03IvantiLinuxPalo-AltoSQL injectionSamsungWindowsactive-exploitationauthentication-bypasscPanelkernel-vulnerabilityknown-exploited-vulnerabilitiesout-of-bounds-writepath-traversalremediationvulnerability-management
What happened
Between April and May 2026 CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Notable entries include Cisco Catalyst SD‑WAN Controller authentication bypass (CVE-2026-20182), BerriAI LiteLLM SQL injection (CVE-2026-42208), Ivanti EPMM input validation (CVE-2026-6973), Palo Alto PAN‑OS out‑of‑bounds write (CVE-2026-0300), a Linux kernel resource transfer vulnerability (CVE-2026-31431), cPanel/WHM missing‑auth (CVE-2026-41940), ConnectWise ScreenConnect path traversal (CVE-2024-1708), a Microsoft Windows protection‑b
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 68df26f0dc836431eebf63e6d5caeca5dcd77aff30db3c556b4d3dc9c4d984ba
- Enrichment time
- 2026-05-14T19:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.