Zero-day report: May 2026
CISA added 21 exploited vulnerabilities to its catalog in May 2026, 10 fewer than April (31). 11 were zero-days, listed within a week of going public. 3 are known to be used by ransomware. The most-hit vendor was Microsoft, with 7.
By technology
Most-hit vendors
Every flaw added in May 2026
- Palo Alto Networks · PAN-OSPalo Alto Networks PAN-OS Authentication Bypass Vulnerability
- TanStack · TanStackTanStack Unspecified Vulnerability
- Nx · Nx ConsoleNx Console Embedded Malicious Code Vulnerability
- Daemon · Daemon Tools LiteDaemon Tools Lite Embedded Malicious Code Vulnerability
- LiteSpeed · cPanel PluginLiteSpeed cPanel Plugin Privilege Escalation Vulnerability
- Drupal · CoreDrupal Core SQL Injection Vulnerability
- Langflow · LangflowLangflow Origin Validation Error Vulnerability
- Trend Micro · Apex OneTrend Micro Apex One (On-Premise) Directory Traversal Vulnerability
- Microsoft · WindowsMicrosoft Windows Buffer Overflow Vulnerability
- Microsoft · DirectXMicrosoft DirectX NULL Byte Overwrite Vulnerability
- Adobe · Acrobat and ReaderAdobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Use-After-Free Vulnerability
- Microsoft · Internet ExplorerMicrosoft Internet Explorer Use-After-Free Vulnerability
- Microsoft · DefenderMicrosoft Defender Link Following Vulnerability
- Microsoft · DefenderMicrosoft Defender Denial of Service Vulnerability
- Microsoft · MicrosoftMicrosoft Exchange Server Cross-Site Scripting Vulnerability
- Cisco · Catalyst SD-WANCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- BerriAI · LiteLLMBerriAI LiteLLM SQL Injection Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
- Palo Alto Networks · PAN-OSPalo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- Linux · KernelLinux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.