[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYtoGDyjUsW9xfpyuaNMyR322FoRhaZa4kbcit0F833w":3},{"article":4,"iocs":54,"watch_terms":121,"solutions":122,"lesson":228},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c6bd45d1-be14-4739-a944-d4badfc3129e","May 2026 CVE Landscape","may-2026-cve-landscape-c2bd94","In May 2026, Insikt Group® identified 41 high-impact vulnerabilities that should be prioritized for remediation, all of which had a Very Critical Recorded Future Risk Score. This represents a 11% increase from last month.","In May 2026, Insikt Group identified 41 high-impact vulnerabilities, an 11% increase from the previous month. Of these, 22 were actively exploited, including 12 that allowed for remote code execution. Notably, five vulnerabilities were over 15 years old, highlighting the continued exploitation of legacy weaknesses. The vulnerabilities affected products from 20 vendors, with Vercel and Microsoft products being significantly impacted.","41 high-impact vulnerabilities identified in May 2026, with 22 actively exploited.","https:\u002F\u002Fbit.ly\u002F4ghl42I","https:\u002F\u002Fwww.recordedfuture.com\u002Fblog\u002Fmedia_1239191713c0e7359a6e3e0dd047fe76e065dcc92.jpg?width=1200&format=pjpg&optimize=medium","2026-06-12T15:47:08+00:00","2026-06-12T16:00:19.668+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Next.js","product",{"name":21,"type":22},"Vercel","vendor",{"name":24,"type":22},"Microsoft",{"name":26,"type":22},"Adobe",{"name":28,"type":22},"Palo Alto Networks",{"name":30,"type":22},"Trend Micro","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118],{"type":56,"value":57,"context":58},"cve","CVE-2008-4250","Microsoft Windows vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":60,"context":61},"CVE-2009-1537","Microsoft DirectX vulnerability, actively exploited.",{"type":56,"value":63,"context":64},"CVE-2009-3459","Adobe Acrobat and Reader vulnerability, actively exploited.",{"type":56,"value":66,"context":67},"CVE-2010-0249","Microsoft Internet Explorer vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":69,"context":67},"CVE-2010-0806",{"type":56,"value":71,"context":72},"CVE-2025-34291","Langflow vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":74,"context":75},"CVE-2026-0257","Palo Alto Networks PAN-OS, Cloud NGFW, and Prisma Access vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":77,"context":78},"CVE-2026-0300","Palo Alto Networks PAN-OS, Cloud NGFW, Prisma Access vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":80,"context":81},"CVE-2026-20182","Cisco Catalyst SD-WAN and SD-WAN Manager vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":83,"context":84},"CVE-2026-31431","Linux Kernel vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":86,"context":87},"CVE-2026-34926","Trend Micro Apex One (On-Premise) vulnerability, actively exploited.",{"type":56,"value":89,"context":90},"CVE-2026-41091","Microsoft Defender vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":92,"context":93},"CVE-2026-42208","BerriAI LiteLLM vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":95,"context":96},"CVE-2026-42897","Microsoft Exchange Server vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":98,"context":99},"CVE-2026-45321","TanStack (Multiple Packages) vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":101,"context":102},"CVE-2026-45498","Microsoft Defender vulnerability, actively exploited.",{"type":56,"value":104,"context":105},"CVE-2026-48027","Nx Console vulnerability, actively exploited.",{"type":56,"value":107,"context":108},"CVE-2026-48172","LiteSpeed cPanel Plugin vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":110,"context":111},"CVE-2026-6973","Ivanti Endpoint Manager Mobile (EPMM) vulnerability, actively exploited, RCE.",{"type":56,"value":113,"context":114},"CVE-2026-8398","Daemon Tools Lite vulnerability, actively exploited.",{"type":56,"value":116,"context":117},"CVE-2026-9082","Drupal Core vulnerability, actively exploited, RCE, PoC available.",{"type":56,"value":119,"context":120},"CVE-2026-26980","Ghost CMS vulnerability, actively exploited, PoC available.",[24,26,28],{"controls":123,"vendors":209},[124,153,181],{"slug":125,"name":126,"problem":127,"products":128},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":154,"name":155,"problem":156,"products":157},"patch-management","Automated patch management","Known holes get closed in days, not months.",[158,166,174],{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":167,"vendor_name":168,"vendor_logo":169,"product_slug":170,"product_name":171,"url":172,"description":173},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":175,"vendor_name":176,"vendor_logo":177,"product_slug":154,"product_name":178,"url":179,"description":180},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":182,"name":183,"problem":184,"products":185},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[186,194,202],{"vendor_slug":187,"vendor_name":188,"vendor_logo":189,"product_slug":190,"product_name":191,"url":192,"description":193},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":195,"vendor_name":196,"vendor_logo":197,"product_slug":198,"product_name":199,"url":200,"description":201},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":203,"vendor_name":24,"vendor_logo":204,"product_slug":205,"product_name":206,"url":207,"description":208},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[210,216,218,222],{"slug":211,"name":212,"logo_path":213,"roles":214},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[215],"affected",{"slug":203,"name":24,"logo_path":204,"roles":217},[215],{"slug":219,"name":28,"logo_path":220,"roles":221},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[215],{"slug":223,"name":224,"logo_path":225,"roles":226},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png",[227],"reported_by",{"slug":229,"title":230,"body":231,"framework_refs":232,"framework_notes":238},"legacy-vulnerabilities-drive-may-2026-exploit-campaign","Legacy Vulnerabilities Drive May 2026 Exploit Campaign","May 2026 saw a significant spike in actively exploited vulnerabilities, with 22 of 41 high-impact CVEs being weaponized by attackers. The most concerning finding was that five vulnerabilities were over 15 years old, demonstrating how legacy systems continue to provide attack vectors for threat actors. This highlights critical gaps in vulnerability management programs, where organizations fail to maintain comprehensive asset inventories and systematic patching processes. The presence of decade-plus-old vulnerabilities in active exploitation indicates that many organizations are running unsupported or poorly maintained systems.",[233,234,235,236,237],"CIS Control 7 (Continuous Vulnerability Management)","NIST SP 800-40 (Patch Management)","CIS Control 1 (Inventory and Control of Enterprise Assets)","CIS Control 2 (Inventory and Control of Software Assets)","NIST CSF PR.IP-12 (Vulnerability Management Plan)",{}]