U.S. CISA adds a flaw in Microsoft Exchange Server to its Known Exploited Vulnerabilities catalog

Multiple high-impact vulnerabilities and active campaigns were reported: CISA added Microsoft Exchange Server vulnerability CVE-2026-42897 (CVSS 8.1, XSS) to its Known Exploited Vulnerabilities catalog and Microsoft confirmed active exploitation. CISA also added a Cisco Catalyst SD‑WAN flaw (CVE-2026-20182, CVSS 10.0) to KEV. OpenAI was hit by a TanStack supply‑chain attack that compromised two employee devices and exposed repository credentials. Russia-linked Turla evolved its Kazuar backdoor into a modular P2P botnet for stealthy, long-term access. Pwn2Own Berlin 2026 revealed many zero-days