Flaws added in May 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in May 2026. For the newest, see Exploited flaws.
In May 2026, CISA added 21 flaws to its list of vulnerabilities being used in attacks, 6 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Microsoft (7), Palo Alto Networks (2) and Daemon (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in May 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-0257† Used in ransomwareAt work |
Palo Alto Networks PAN-OS. Attackers can get into Palo Alto Networks PAN-OS without a valid password. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-8398At work |
Daemon Tools Lite. A tampered release of Daemon Tools Lite was published with malicious code built in. | At work |
CVE-2026-48027† Used in ransomwareAt work |
Nx Console. A tampered release of Nx Console was published with malicious code built in. | At work |
CVE-2026-45321† Used in ransomwareAt work |
TanStack. Attackers are using a flaw in TanStack that its maker hasn't described in detail. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-48172At work |
LiteSpeed cPanel Plugin. Someone who already has a foothold can use LiteSpeed cPanel Plugin to take full control of the machine. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-9082At work |
Drupal Core. Attackers can run their own code on Drupal Core. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-34926At work |
Trend Micro Apex One. Attackers can read files on Trend Micro Apex One that should be out of reach from anywhere, without logging in. | At work |
CVE-2025-34291At work |
Langflow. A booby-trapped web page can run an attacker's code through Langflow. | At work |
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-45498At home |
Microsoft Defender. Attackers can crash Microsoft Defender or stop it working. | At home |
CVE-2026-41091At home |
Microsoft Defender. Someone who already has a foothold can use Microsoft Defender to take full control of the machine. | At home |
CVE-2010-0806At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2010-0249At home |
Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer. | At home |
CVE-2009-3459At home |
Adobe Acrobat and Reader. Opening a booby-trapped file can let an attacker run their own code through Adobe Acrobat and Reader. | At home |
CVE-2009-1537At work |
Microsoft DirectX. Attackers can run their own code on Microsoft DirectX. | At work |
CVE-2008-4250At home |
Microsoft Windows. Attackers can run their own code on Microsoft Windows. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-42897At work |
Microsoft. Attackers can run code in the browser of someone using Microsoft and act as them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20182At work |
Cisco Catalyst SD-WAN. Attackers can get into Cisco Catalyst SD-WAN without a valid password. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-42208At work |
BerriAI LiteLLM. Attackers can read or change the database behind BerriAI LiteLLM from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-6973At work |
Ivanti Endpoint Manager Mobile (EPMM). Someone who already has a way in can use Ivanti Endpoint Manager Mobile (EPMM) to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-0300At work |
Palo Alto Networks PAN-OS. Attackers can run their own code on Palo Alto Networks PAN-OS from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-31431At work |
Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. | At work |
Companies
The flaws were in 14 companies’ products; the most were in Microsoft’s (7).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 7 | – |
| Palo Alto Networks | 2 | 1 |
| Adobe | 1 | – |
| BerriAI | 1 | – |
| Cisco | 1 | – |
| Daemon | 1 | – |
| Drupal | 1 | – |
| Ivanti | 1 | – |
| Langflow | 1 | – |
| Linux | 1 | – |
| LiteSpeed | 1 | – |
| Nx | 1 | 1 |
| TanStack | 1 | 1 |
| Trend Micro | 1 | – |
Other months
Every month since CISA started the list; May 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.