CISA Adds Seven Known Exploited Vulnerabilities to Catalog
2026-05-21T15:24:14Z•9f68c8694496f468bfbf79b37a863123212767c08eda9fbad95e6b91515f0410
AdobeBOD 22-01BerriAICISACVECisco SD-WANDoSEoPExchangeIvantiKEV CatalogLinux KernelMicrosoftPalo Alto NetworksSQL injectionXSSactive exploitationpatchingvulnerability management
What happened
CISA added multiple CVEs to its Known Exploited Vulnerabilities (KEV) Catalog in May 2026 based on evidence of active exploitation. Newly listed issues affect Microsoft products (Windows, Internet Explorer, Exchange, Defender), Adobe Acrobat/Reader, Linux kernel, Cisco SD‑WAN, Palo Alto PAN‑OS, Ivanti EPMM, and a BerriAI LiteLLM SQL injection. CISA cites Binding Operational Directive 22‑01 and urges timely remediation by federal agencies and other organizations to reduce exposure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 9f68c8694496f468bfbf79b37a863123212767c08eda9fbad95e6b91515f0410
- Enrichment time
- 2026-05-21T15:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.