Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement
2026-05-22T07:23:46Z•0ef4245ab564affcb1aa54dc10bb9fe4e8d96254f836aaaa0d583aee232732fa
attack-surface-managementauthentication-bypassciscoctemexploited-in-the-wildgeopoliticsinitial-accesslaw-enforcement-takedownsmetasploitpalo-alto-networksransomwaresd-wanvulnerability-exploitationzero-click
What happened
Rapid7’s May 2026 collection highlights a shift from social engineering to direct vulnerability exploitation (38% of initial access), with over half of exploited flaws being zero-click, network-facing issues that are rapidly weaponized once public discussion spikes. Notable technical disclosures include a critical authentication bypass in Cisco Catalyst SD‑WAN Controller (CVE-2026-20182, CVSS 10.0, exploited/fixed) and a high-severity PAN‑OS authentication bypass (CVE-2026-0265, 7.2), alongside several other product vulnerabilities (Marvell QConvergeConsole, GestioIP, Dolibarr) called out in a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 0ef4245ab564affcb1aa54dc10bb9fe4e8d96254f836aaaa0d583aee232732fa
- Enrichment time
- 2026-05-22T07:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.