CISA Adds One Known Exploited Vulnerability to Catalog
2026-05-08T19:24:14Z•f33223b11cfed7670a4514f0d9e18b29d8ea0b6a454ec38638db0ea948b83780
BOD 22-01BerriAICISAConnectWiseD-LinkIvantiKEVLinux kernelMicrosoft WindowsPalo AltoSQL injectionSamsungSimpleHelpcPanelcommand injectionimproper input validationknown exploited vulnerabilitiesmissing authenticationmissing authorizationout-of-bounds writepath traversalvulnerability management
What happened
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog (late Apr–early May 2026) based on evidence of active exploitation. Affected products include BerriAI LiteLLM (SQL injection), Ivanti Endpoint Manager Mobile (improper input validation), Palo Alto Networks PAN-OS (out-of-bounds write), the Linux kernel (incorrect resource transfer between spheres), WebPros cPanel & WHM / WP2 (missing authentication), ConnectWise ScreenConnect (path traversal), Microsoft Windows (protection mechanism failure), Samsung MagicINFO (path traversal), SimpleHelp (missing/insuff.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- f33223b11cfed7670a4514f0d9e18b29d8ea0b6a454ec38638db0ea948b83780
- Enrichment time
- 2026-05-08T19:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.