CISA KEV · May 2026
In May 2026, CISA added 21 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, down from 31 in April 2026. 3 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (7), Palo Alto Networks (2), Nx (1). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 29 May 2026 | CVE-2026-0257 | Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityRANSOMWAREPalo Alto Networks · PAN-OS | |
| 27 May 2026 | CVE-2026-8398 | Daemon Tools Lite Embedded Malicious Code VulnerabilityDaemon · Daemon Tools Lite | |
| 27 May 2026 | CVE-2026-48027 | Nx Console Embedded Malicious Code VulnerabilityRANSOMWARENx · Nx Console | |
| 27 May 2026 | CVE-2026-45321 | TanStack Unspecified VulnerabilityRANSOMWARETanStack · TanStack | |
| 26 May 2026 | CVE-2026-48172 | LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityLiteSpeed · cPanel Plugin | |
| 22 May 2026 | CVE-2026-9082 | Drupal Core SQL Injection VulnerabilityDrupal · Core | |
| 21 May 2026 | CVE-2026-34926 | Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityTrend Micro · Apex One | |
| 21 May 2026 | CVE-2025-34291 | Langflow Origin Validation Error VulnerabilityLangflow · Langflow | |
| 20 May 2026 | CVE-2026-45498 | Microsoft Defender Denial of Service VulnerabilityMicrosoft · Defender | |
| 20 May 2026 | CVE-2026-41091 | Microsoft Defender Link Following VulnerabilityMicrosoft · Defender | |
| 20 May 2026 | CVE-2010-0806 | Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft · Internet Explorer | |
| 20 May 2026 | CVE-2010-0249 | Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft · Internet Explorer | |
| 20 May 2026 | CVE-2009-3459 | Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityAdobe · Acrobat and Reader | |
| 20 May 2026 | CVE-2009-1537 | Microsoft DirectX NULL Byte Overwrite VulnerabilityMicrosoft · DirectX | |
| 20 May 2026 | CVE-2008-4250 | Microsoft Windows Buffer Overflow VulnerabilityMicrosoft · Windows | |
| 15 May 2026 | CVE-2026-42897 | Microsoft Exchange Server Cross-Site Scripting VulnerabilityMicrosoft · Microsoft | |
| 14 May 2026 | CVE-2026-20182 | Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Catalyst SD-WAN | |
| 8 May 2026 | CVE-2026-42208 | BerriAI LiteLLM SQL Injection VulnerabilityBerriAI · LiteLLM | |
| 7 May 2026 | CVE-2026-6973 | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityIvanti · Endpoint Manager Mobile (EPMM) | |
| 6 May 2026 | CVE-2026-0300 | Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityPalo Alto Networks · PAN-OS | |
| 1 May 2026 | CVE-2026-31431 | Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityLinux · Kernel |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
21 vulnerabilities. In April 2026 it added 31.
Microsoft, with 7 entries. Next were Palo Alto Networks (2), Nx (1), TanStack (1).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →