Threat Intelligence Report — May 20, 2026 | 7 New KEVs · 135 Victims

Report Date: 2026-05-20

New KEVs: 7Critical CVEs: 5Ransomware Victims: 135

7 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. 5 additional critical-severity CVEs have been published to the NVD but not yet confirmed as exploited — Microsoft products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference Turla (Russia). Ransomware activity is moderate with 135 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.

Patch This Week

The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.

1. CVE-2026-20182 – Cisco Catalyst SD-WAN | CVSS 10.0
   CISA deadline: 2026-05-17 (overdue by 3d) — Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
2. CVE-2026-42897 – Microsoft Microsoft | CVSS 8.1
   CISA deadline: 2026-05-29 (9d remaining) — Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
3. CVE-2008-4250 – Microsoft Windows | CVSS 9.8 | PoC Available
   CISA deadline: 2026-06-03 (14d remaining) — Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Top KEVs

Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.

New Today

• CVE-2008-4250 – Microsoft Windows | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 93.5% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2009-1537 – Microsoft DirectX | CVSS 8.8 (HIGH) | AV: Network | EPSS 68.1% / 99th pct | Ransomware Use: No
• CVE-2009-3459 – Adobe Acrobat and Reader | CVSS 8.8 (HIGH) | AV: Network | EPSS 87.0% / 100th pct | Ransomware Use: No
• CVE-2010-0249 – Microsoft Internet Explorer | CVSS 8.8 (HIGH) | AV: Network | EPSS 90.1% / 100th pct | Ransomware Use: No | PoC Available
• CVE-2010-0806 – Microsoft Internet Explorer | CVSS 8.8 (HIGH) | AV: Network | EPSS 89.5% / 100th pct | Ransomware Use: No

Still Outstanding

• CVE-2026-20182 – Cisco Catalyst SD-WAN | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 23.7% / 96th pct | Ransomware Use: No
• CVE-2026-42897 – Microsoft Microsoft | CVSS 8.1 (HIGH) | AV: Network | EPSS 10.0% / 93th pct | Ransomware Use: No

Major CVEs

Critical-severity CVEs published in the last 7 days that are not yet in the CISA KEV catalog — not confirmed exploited, but severe enough to assess and prioritize patching before they are. 3 new today.

• CVE-2026-20223New – Unknown Vendor | CVSS 10.0 (CRITICAL) | AV: Network | Published: today
  A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role.

  Th…

• CVE-2026-42822 – Unknown Vendor | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 0.1% / 25th pct | Published: 2 days ago
  Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-41553 – dhtmlx Pdf Export Module | CVSS 10.0 (CRITICAL) | AV: Network | EPSS 0.3% / 49th pct | Published: 5 days ago
  PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to…
• CVE-2026-6555New – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.3% / 50th pct | Published: today
  The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array und…
• CVE-2026-7284New – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.1% / 22th pct | Published: today
  The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle…

Security News

Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.

• CISA ICS AdvisoryAdvisory · yesterday – Kieback & Peter DDC Building Controllers
  View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take control of the victim's browser. The following versions of Kieback & Peter DDC Building Controllers are affected: DDC400…
• CISA ICS AdvisoryAdvisory · yesterday – Siemens RUGGEDCOM APE1808 Devices
  View CSAF Summary A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with…
• CISA ICS AdvisoryAdvisory · yesterday – ABB CoreSense HM and CoreSense M10
  View CSAF Summary An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain a…
• Unit 42Incident · today – The npm Threat Landscape: Attack Surface and Mitigations (Updated May 20)
  Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage attacks and more. The post The npm Threat Landscape: Attack Surface and Mitigations (Updated May 20) …
• Unit 42Research · today – Tracking TamperedChef Clusters via Certificate and Code Reuse
  Unit 42 analyzes TamperedChef malware clusters that use trojanized productivity apps and malvertising to deliver stealthy payloads to targets. The post Tracking TamperedChef Clusters via Certificate and Code Reuse appear…
• Sophos X-OpsResearch · yesterday – WantToCry ransomware remotely encrypts files
  Brute-force attempts against SMB services can be early signs of an attack Categories: Threat Research Tags: Ransomware, WantToCry, SMB
• Sophos X-OpsResearch · 6 days ago – Why AMOS matters: The macOS malware stealing data at scale
  <p>Sophos X-Ops looks at the Atomic macOS Stealer and its capabilities</p> Categories: Threat Research Tags: MacOS, AMOS, infostealer
• The RecordIncident · today – Ukraine probes teen suspect in cyber theft scheme targeting California online shoppers
  The investigation began after U.S. authorities informed their Ukrainian counterparts that hackers operating from Ukraine could be involved in attacks targeting users of American e-commerce platforms, Ukraine's Prosecutor…
• The RecordIncident · today – 7-Eleven confirms breach after ShinyHunters claims
  The breach notification letters say 7-Eleven discovered the breach on April 8 and, after an investigation, determined that the cybercriminals gained access to “certain 7-Eleven systems used to store franchisee document…
• Security Affairs (APT)Incident · 4 days ago – Russian APT Turla builds long-term access tool with Kazuar Botnet evolution
  Russia-linked APT group Turla turned its Kazuar malware into a stealthy P2P botnet for long-term access to compromised systems. Russia-linked APT group Turla upgraded its Kazuar backdoor into a modular peer-to-peer botne…
• Security Affairs (APT)Incident · 5 days ago – Ghostwriter group resumes attacks on Ukrainian Government targets
  ESET uncovered new Ghostwriter (aka FrostyNeighbor) activity targeting Ukrainian government organizations in a campaign active since March 2026. ESET researchers published a new report documenting fresh activity attribut…
• Security Affairs (Cybercrime)Incident · today – A malicious VS code extension just breached GitHub ‘s internal repositories
  One employee installed a trojanized VS Code extension. Result: ~3,800 GitHub internal repositories exfiltrated. TeamPCP claims credit, wants $50K. There is something almost ironic about GitHub, the platform that hosts th…
• Security Affairs (Cybercrime)News · yesterday – Microsoft dismantled malware-signing network Fox Tempest
  Microsoft disrupted Fox Tempest, a malware-signing-as-a-service (MSaaS) that allowed attackers to sign malware with fake trusted certificates. Microsoft said it disrupted a cybercrime operation run by a threat actor name…
• Bleeping ComputerIncident · today – Ukraine identifies infostealer operator tied to 28,000 stolen accounts
  The Ukrainian cyberpolice, working in conjunction with U.S. law enforcement, has identified an 18-year-old man from Odesa suspected of running an infostealer malware operation targeting users of an online store in Califo…
• The Hacker NewsIncident · today – Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks
  Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromisi…

Ransomware Activity

Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.

13 new victims posted today
7-day total: 135 via Ransomware.live

Infostealer Exposure: 284 employee credentials and 7,010 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.

Most Active Groups

Group Intelligence

• Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice do…
• Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against W…
• Dragonforce — DragonForce is a major ransomware-as-a-service operation first observed in August 2023 that launched a formal affiliate program offering 80% revenue share, then rebranded as a "ransomware cartel" in 2…
• Safepay — SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-20…
• Nova — Nova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’files and uses double-extortion tactics to pressure organizations into paying for decryption and data non-disclos…

Most Targeted Sectors

Top Countries

US (46), GB (12), DE (8), AU (7), ES (5)

Notable Incidents

• Generation Life (Healthcare · AU) — claimed by Qilin. N/A Press coverage →
• Goodstone Group (Not Found · AU) — claimed by Cmdorganization. Goldberg Coins & Collectibles Inc. is a family-owned business specializing in numismatic auctions and collectibles, with a legacy dating back to 1930. The company offers expert auction services, personal consultations, a… Press coverage →
• harrisoncountywv.com (Public Sector · US) — claimed by Safepay. The Commission functions as the executive administrative body for the county and is responsible for overseeing public infrastructure, fiscal management, … Press coverage →

Vendor-Specific Risks

Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.