CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-18T17:24:14Z•8e7c3091e70e1999d9be643222603b539a27c0c924c33864aceefa853049f7f1
BOD-22-01BerriAICisco-SD-WANIvantiKEVLinux-KernelMicrosoft-ExchangePalo-Altoactive-exploitationauthentication-bypasscPanelcisaknown-exploited-vulnerabilitiesmissing-authenticationout-of-bounds-writesql-injectionvulnerability-managementxss
What happened
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Affected products include Microsoft Exchange (XSS), Cisco Catalyst SD‑WAN Controller (authentication bypass), BerriAI LiteLLM (SQL injection), Ivanti Endpoint Manager Mobile (improper input validation), Palo Alto Networks PAN‑OS (out‑of‑bounds write), the Linux kernel (incorrect resource transfer), and WebPros cPanel & WHM / WP2 (missing authentication). CISA references Binding Operational Directive (BOD) 22‑01 and urges timely remediation or mitigation as required
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 8e7c3091e70e1999d9be643222603b539a27c0c924c33864aceefa853049f7f1
- Enrichment time
- 2026-05-18T17:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.