Threat Intelligence Report — May 8, 2026 | 3 New KEVs · 179 Victims

by

Report Date: 2026-05-08

New KEVs: 3Critical CVEs: 5Ransomware Victims: 179

3 vulnerabilities were added to the CISA Known Exploited Vulnerabilities catalog this period. 5 additional critical-severity CVEs have been published to the NVD but not yet confirmed as exploited — Berriai products show the strongest concentration of risk signals this week. Threat intelligence sources this period reference Salt Typhoon (China) and MuddyWater (Iran). Ransomware activity is moderate with 179 new victims posted to leak sites over the last 7 days, with Qilin posting the most victims.

Patch This Week

The top 3 KEVs to remediate right now, ranked by CISA deadline proximity, ransomware exploitation, and severity. These are confirmed exploited — if you do nothing else today, patch these.

  1. CVE-2026-0300 – Palo Alto Networks PAN-OS | CVSS 9.3
    CISA deadline: 2026-05-09 (1d remaining) — Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: – Restrict User-ID Authentication Portal access to only trusted zones. – Disable User-ID Authentication Portal if not required.
  2. CVE-2026-6973 – Ivanti Endpoint Manager Mobile (EPMM) | CVSS 7.2
    CISA deadline: 2026-05-10 (2d remaining) — Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  3. CVE-2026-42208 – BerriAI LiteLLM | CVSS 9.3
    CISA deadline: 2026-05-11 (3d remaining) — Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Top KEVs

Vulnerabilities confirmed actively exploited in the wild by CISA — ranked by ransomware use, then severity. Patch these before anything else.

New Today

  • CVE-2026-42208 – BerriAI LiteLLM | CVSS 9.3 (CRITICAL) | AV: Network | EPSS 0.1% / 24th pct | Ransomware Use: No

Still Outstanding

  • CVE-2026-0300 – Palo Alto Networks PAN-OS | CVSS 9.3 (CRITICAL) | AV: Network | EPSS 4.7% / 89th pct | Ransomware Use: No
  • CVE-2026-6973 – Ivanti Endpoint Manager Mobile (EPMM) | CVSS 7.2 (HIGH) | AV: Network | EPSS 5.0% / 90th pct | Ransomware Use: No

Major CVEs

Critical-severity CVEs published in the last 7 days that are not yet in the CISA KEV catalog — not confirmed exploited, but severe enough to assess and prioritize patching before they are.

  • CVE-2026-6508 – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.0% / 6th pct | Published: yesterday
    Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs.

    This issue affects Liderahenk: from 2.0.1 befo…

  • CVE-2026-5722 – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.2% / 42th pct | Published: 3 days ago
    The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow not invalidating or regenerating verificat…
  • CVE-2025-13618 – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.1% / 21th pct | Published: 3 days ago
    The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mento…
  • CVE-2026-5294 – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.2% / 41th pct | Published: 3 days ago
    The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing attacker-controlled model/function dispatch and reaching a pl…
  • CVE-2025-14320 – Unknown Vendor | CVSS 9.8 (CRITICAL) | AV: Network | EPSS 0.0% / 15th pct | Published: 4 days ago
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS.

    Th…

Security News

Advisories, threat research, and incident reports from 12 sources across government, commercial research, and security journalism — prioritized by source credibility.

Threat Actors Mentioned

Salt Typhoon (China)MuddyWater (Iran)

Ransomware Activity

Victim counts posted to ransomware group leak sites — use this to gauge which groups are most active and which sectors and regions are being targeted.

28 new victims posted today
7-day total: 179 via Ransomware.live

Infostealer Exposure: 4,700 employee credentials and 280,421 user credentials compromised via infostealer malware across victim organisations — indicating credential theft likely preceded these ransomware deployments.

Most Active Groups

Qilin 34 Thegentlemen 27 Safepay 15 Bavacai 15 Akira 13

Group Intelligence

  • Qilin — Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice do…
  • Thegentlemen — The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against W…
  • Safepay — SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-20…
  • Akira — The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.<br> <br> It's worth noting that with the end of CONT…

Most Targeted Sectors

Business Services 36 Manufacturing 23 Technology 18 Consumer Services 14 Transportation/Logistics 11

Top Countries

US (65), GB (12), IT (12), CA (10), DE (10)

Notable Incidents

  • Instructure Holdings, Inc. (Canva LMS, instructure.com) (Education · US) — claimed by Shinyhunters. Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and oth… Press coverage →
  • Standard-Examiner (Public Sector · US) — claimed by Qilin. N/A Press coverage →

Vendor-Specific Risks

Vendors with confirmed KEV exploitation this week — the stacked bar shows how that exposure breaks down across exploited CVEs (red), critical CVEs to watch (orange), and news mentions (yellow). Prioritize patching vendors with the largest red segment.

Berriai 1 Ivanti 1 Palo Alto Networks 1 KEVs CVEs Mentions

Stay Ahead

Found this useful? Get the daily report in your reader.

Free. No account. No email. Follow in Feedly, Inoreader, or any RSS reader.

Or follow on X for alerts in your feed:

Follow @threatpodium on X →