Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement
2026-05-21T19:23:49Z•92be0f550005eb814d2404c4842b9db47c823a2bf154b8dfa1d07a2de1af0df2
attack-surface-managementauthentication-bypassciscoctemgeopoliticsinitial-accesslaw-enforcement-takedownsmetasploitnetwork-devicespalo-altopan-osransomwaresd-wanthreat-landscapevulnerability-exploitationzero-click
What happened
Rapid7’s May 2026 posts cover a Q1 Threat Landscape report and multiple research/advisory items highlighting a shift toward vulnerability exploitation (38% initial access) — notably zero-click, network‑facing flaws — and faster operationalization of public vulnerability discussion. The feed includes product/CTEM/ASM updates (Surface Command dashboards) and Metasploit module activity, plus multiple high‑impact disclosures: CVE-2026-20182 (Cisco Catalyst SD‑WAN Controller — critical authentication bypass, CVSS 10.0, allows a remote unauthenticated attacker to become an authenticated peer and run
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 92be0f550005eb814d2404c4842b9db47c823a2bf154b8dfa1d07a2de1af0df2
- Enrichment time
- 2026-05-21T19:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.