CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-27T13:24:12Z•7dbfcb43471b0881d87f5534742b599ca7122a6099452ba8d21e20e8c46265af
Authentication BypassBOD 22-01BerriAICISACisco SD-WANCross-Site ScriptingDenial of ServiceDirectory TraversalDrupal CoreElevation of PrivilegeKEV CatalogLangflowLiteSpeedMicrosoft DefenderMicrosoft ExchangePrivilege EscalationSQL InjectionTrend Micro Apex Oneactive exploitationcPanelvulnerability management
What happened
In May 2026 CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Affected products include LiteSpeed cPanel (privilege escalation), Drupal Core (SQL injection), Langflow (origin validation), Trend Micro Apex One (directory traversal), Microsoft products including Exchange and Defender (XSS, elevation-of-privilege, DoS), Cisco Catalyst SD‑WAN (authentication bypass), BerriAI LiteLLM (SQL injection), and several legacy client-side flaws. CISA reiterates BOD 22-01 remediation requirements and urges all organizations to迅
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 7dbfcb43471b0881d87f5534742b599ca7122a6099452ba8d21e20e8c46265af
- Enrichment time
- 2026-05-27T13:24:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.