a13e Intel

Windows MiniPlasma - Zero-Day Exploit Gives SYSTEM Access

What changed vs yesterday

Confidence: High

Yesterday's bundle led with Cisco Catalyst SD-WAN and Funnel Builder because both were active-exploitation priorities. Today's delta is different. Windows MiniPlasma is the only NEW finding in the 18 May source set, and it carries the strongest operational signal in the current material: SYSTEM-level access, a released PoC, and confirmed active exploitation.

The practical shift is simple. Keep Cisco and Funnel Builder in urgent owner queues, but move Windows exposure review to the front of today's discussion. For Cisco, retain the explicit identifier CVE-2026-20182 and the CISA KEV context so remediation owners can map it cleanly. Do not attach a CVE or CVSS score to MiniPlasma unless a later source provides one. The current material does not include either.

Finding 1: Windows MiniPlasma is a new active-exploitation item

Confidence: High

BleepingComputer describes a new Windows zero-day exploit called MiniPlasma. The reported impact is SYSTEM-level access, with proof-of-concept code released and active exploitation confirmed in the current material. That combination makes it a live exposure question, not a routine patch note.

Security teams should start with asset and telemetry review rather than broad assumptions. Identify Windows systems with higher operational or administrative value, check endpoint detection coverage, review privilege-escalation alerts, and watch for vendor guidance or later identifiers. Until Microsoft or another primary source assigns a new CVE, track this by the MiniPlasma name and source URL. The public PoC references historical CVE-2020-17103 as related prior research; that should not be treated as a new MiniPlasma CVE assignment.

Update: Cisco SD-WAN remains an active-exploitation patch priority

Confidence: High

The Record source states that CISA has ordered federal agencies to patch an actively exploited bug in Cisco SD-WAN systems. The identifier to track is CVE-2026-20182, Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability, which CISA added to the Known Exploited Vulnerabilities catalog. This is not today's new lead because Cisco SD-WAN was already the centre of yesterday's bundle, but it still belongs in the urgent queue.

For owners, the action has not softened. Confirm whether Cisco Catalyst SD-WAN Controller or Manager components are exposed, verify patch or mitigation state for CVE-2026-20182, and keep the item visible to network and infrastructure owners. Use today's update as a check on completion, not a reason to rewrite the story from scratch.

Update: Funnel Builder for WooCommerce remains checkout-skimming risk

Confidence: High

The Hacker News source states that a critical Funnel Builder flaw continues to be actively exploited for WooCommerce checkout skimming. That points directly at ecommerce payment flows, where small delays can become customer-impacting incidents.

Teams running WooCommerce should confirm whether Funnel Builder is installed, check plugin version and mitigation status, and inspect checkout pages for injected scripts or unexpected form behaviour. Treat any revenue-generating store as a priority review.

Update: American Lending Center breach is a lower-confidence incident signal

Confidence: Low

SecurityWeek reports that American Lending Center disclosed a breach affecting 123,000 individuals. The current source set gives this item low confidence and does not frame it as a patchable software vulnerability.

The value for clients is sector awareness. Lending and financial-services teams can use it to review third-party data handling, notification readiness, and retention controls. It should not be treated as evidence of a new exploitable product flaw.

Update: Chrome 148 belongs in browser hygiene checks

Confidence: Low

SecurityWeek reports that Chrome 148 patches critical vulnerabilities. The current source set does not include CVE identifiers or active-exploitation evidence for this item.

That keeps the response measured. Confirm that managed-browser updates are landing, especially on privileged endpoints and shared workstations. Avoid calling this a known exploited browser emergency unless stronger source data appears.

Update: Grafana token breach shows developer-platform exposure

Confidence: Medium

The Hacker News source states that a Grafana GitHub token breach led to codebase download and an extortion attempt. Active exploitation is not confirmed, but the incident is still a useful reminder that developer-platform credentials can become incident paths.

Review token scope, rotation cadence, repository access, and monitoring for unusual clone or download activity. The strongest action is credential hygiene, not panic over the wider Grafana ecosystem.

Update: Azure no-CVE rejection creates a tracking gap

Confidence: Medium

BleepingComputer reports that Microsoft rejected a critical Azure vulnerability report and did not issue a CVE. The missing CVE is a material caveat because scanner, ticketing, and dashboard workflows often depend on formal identifiers.

Cloud teams should log this as a watchpoint, map whether the affected service area is relevant, and wait for stronger vendor or researcher detail before making estate-wide claims. The operational risk is the tracking gap as much as the reported vulnerability itself.

Update: NGINX public PoC raises watch pressure, not confirmed exploitation

Confidence: Medium

SecurityWeek reports that public proof-of-concept code exists for a critical NGINX vulnerability. The caveat matters: active exploitation has not been confirmed in the current sweep.

Owners should identify exposed NGINX Open Source and NGINX Plus deployments, verify applicability, and prepare patches or mitigations where exposure exists. This is a validation and readiness task, not a confirmed incident.

Update: TanStack remains a developer-device supply-chain follow-up

Confidence: Medium

The Hacker News source states that a TanStack npm supply-chain attack affected two OpenAI employee devices and forced macOS updates. The current source set does not say customer environments are actively exploited.

Developer and platform teams should check macOS update completion, package history, lockfiles, token rotation, and endpoint telemetry. Keep the claim narrow: this is a developer-device and supply-chain follow-up.

Why This Matters

Today's useful signal is the separation between a fresh active-exploitation lead and ongoing remediation work. Windows MiniPlasma needs immediate triage because the source set records SYSTEM access, PoC release, and active exploitation. Cisco SD-WAN and Funnel Builder still matter, but they are continuity items from yesterday's urgent queue; Cisco remains CVE-2026-20182 / CISA KEV remediation work, not an unnamed SD-WAN item.

• Recommended Actions
• Open a same-day triage item for Windows MiniPlasma, tracked by name until a CVE or vendor identifier exists.
• Review high-value Windows endpoints for privilege-escalation telemetry and EDR coverage.
• Confirm Cisco SD-WAN CVE-2026-20182 patch or mitigation state with network owners.
• Check WooCommerce sites for Funnel Builder exposure and checkout-page tampering.
• Keep Azure no-CVE, NGINX PoC, Grafana token, TanStack, Chrome 148, and American Lending Center items in watch or hygiene queues according to owner relevance.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 18 May 2026.

Cisco SD-WAN: KEV-Listed Auth Bypass Leads Today’s Queue

What changed vs yesterday

Confidence: High

Yesterday’s pack was dominated by Cisco SD-WAN remediation, TanStack/OpenAI supply-chain checks, Linux Kernel/Fragnesia, GitLab, and a broad BSI advisory queue. Today is narrower. The reviewed source set marks Cisco SD-WAN and Funnel Builder as active-exploitation items, so they take priority over the lower-confidence breach, browser, research, cloud, supply-chain, and NGINX watchpoints.

Finding 1: Cisco Catalyst SD-WAN CVE-2026-20182 is KEV-listed and needs immediate triage

Confidence: High

CISA has ordered United States federal agencies to address Cisco Catalyst SD-WAN CVE-2026-20182 by 17 May 2026. CISA’s Known Exploited Vulnerabilities catalogue describes it as a Cisco Catalyst SD-WAN Controller authentication bypass affecting Controller and Manager, allowing an unauthenticated remote attacker to bypass authentication and obtain administrative privileges. Cisco’s advisory records CVSS 10.0 severity.

Treat this as an immediate exposure, patch-verification, and hunting task. Identify Cisco Catalyst SD-WAN Controller and Manager deployments, confirm affected versions and fixed-state, review exposed administrative and control-plane paths, and follow CISA ED 26-03 plus Cisco guidance. Use CVE-2026-20182 as the tracking identifier; do not route this as an unnamed Cisco patch order.

Finding 2: Funnel Builder for WooCommerce is being abused for checkout skimming

Confidence: High

The Hacker News reporting in the source set says a critical Funnel Builder flaw is under active exploitation and is being used for WooCommerce checkout skimming. That makes this a direct ecommerce risk rather than a generic plugin advisory.

Teams running WooCommerce should check whether Funnel Builder is installed, verify plugin version and patch status, and look for checkout-page tampering or unexpected payment-form behaviour. If the plugin is present on revenue-generating stores, treat review and remediation as urgent.

Finding 3: American Lending Center breach is an incident watchpoint

Confidence: Low

SecurityWeek reports that American Lending Center experienced a breach affecting 123,000 individuals. The source set includes it as a finding, but it is an incident report rather than a patchable vulnerability item.

The decision value is mainly sector awareness. Financial-services and lending organisations should compare the report against their own third-party, data-retention, and breach-notification controls, but should not treat it as evidence of a new exploitable software flaw.

Finding 4: Chrome 148 patching should stay in endpoint hygiene queues

Confidence: Low

SecurityWeek reports that Chrome 148 patches critical vulnerabilities. The source set does not include CVE identifiers or active-exploitation evidence for this item.

That keeps the action measured: confirm managed-browser update cadence and check that high-risk endpoints are not lagging behind. Without identifiers in the source set, avoid overstating this as a known exploited browser emergency.

Finding 5: LABScon Breach Alpha is useful context, not a vulnerability alert

Confidence: Low

SentinelOne’s LABScon25 replay, Breach Alpha: Trading on Cyber Fallout, is included as a research signal. The source describes it as insight into the financial implications of cyber breaches, not as a direct vulnerability.

Use it for executive context and tabletop thinking. Do not route it as a patch ticket or incident unless separate evidence links it to a live exposure.

Finding 6: Microsoft Azure no-CVE rejection creates a tracking gap

Confidence: Medium

BleepingComputer reports that Microsoft rejected a critical Azure vulnerability report and did not issue a CVE. The source flags the absence of a CVE as a caveat because it makes normal vulnerability tracking harder.

Cloud teams should log the issue as a watchpoint, review whether the reported service area is relevant to their Azure estate, and wait for stronger vendor or researcher detail before making broad claims. The risk is not only the technical report. It is also the operational gap created when a cloud issue has no CVE for scanners, tickets, and dashboards.

Finding 7: OpenAI/TanStack remains a developer-device supply-chain follow-up

Confidence: High

The Record, The Hacker News, and BleepingComputer reporting in the source set describe OpenAI asking macOS users to update after a TanStack npm supply-chain attack affected employee devices. This is high-confidence supply-chain reporting, but the source does not mark active exploitation in customer environments.

Developer teams should review macOS patch completion, npm package history, lockfiles, token rotation, and endpoint telemetry for affected developer devices. Keep the wording narrow: this is a TanStack/OpenAI supply-chain follow-up, not evidence that every npm environment is compromised.

Finding 8: NGINX PoC publication raises exploit-development risk

Confidence: Medium

SecurityWeek reports that proof-of-concept code has been published for a critical NGINX vulnerability. The source does not mark active exploitation for this item, but public PoC code changes the risk timeline.

NGINX owners should identify internet-facing NGINX Open Source and NGINX Plus deployments, verify whether the reported vulnerability applies, and prioritise patching or mitigations where public exposure exists. The right posture is fast validation, not panic.

Why This Matters

Today’s bundle separates urgent exploitation response from noisy security news. Cisco Catalyst SD-WAN CVE-2026-20182 and Funnel Builder deserve immediate owner action. The other findings matter too, but mostly as tracking, hygiene, or enrichment work until better identifiers, exploit evidence, or vendor detail appears.

• Recommended Actions
• Patch or validate exposure for Cisco Catalyst SD-WAN Controller and Manager systems affected by CVE-2026-20182.
• Treat CVE-2026-20182 as CISA KEV-listed and follow CISA ED 26-03 plus Cisco advisory guidance.
• Identify WooCommerce sites using Funnel Builder and check for checkout skimming or page tampering.
• Confirm Chrome managed-update completion, especially on privileged endpoints.
• Track the Azure no-CVE report outside normal CVE-only queues.
• Review OpenAI/TanStack-related developer-device controls, including macOS updates, lockfiles, tokens, and endpoint telemetry.
• Inventory exposed NGINX deployments and watch for exploitation signals tied to the published PoC.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 17 May 2026.

CVE-2026-20182, PAN-OS CVE-2026-0264 and Windows BitLocker Zero-Days Set the 15 May Response Queue

Finding: CISA KEV CVE-2026-20182 needs immediate triage

Confidence: High

CISA has added CVE-2026-20182 to the Known Exploited Vulnerabilities catalogue, and The curated source set marks active exploitation as yes. The brief does not include a CVSS score or detailed product context for this entry, so the immediate task is to identify the affected technology from authoritative CISA or vendor guidance and move it into the exploited-vulnerability queue.

For federal agencies, KEV inclusion creates a binding remediation requirement. For private-sector teams, it is still a strong signal: treat CVE-2026-20182 as exploited until proven out of scope, map exposure quickly and avoid waiting for a fuller daily narrative before assigning ownership.

Finding: Windows BitLocker and CTFMON zero-days widen the Microsoft watchpoint

Confidence: High

The source set cites The Hacker News reporting Windows zero-days that can bypass BitLocker and lead to privilege escalation through CTFMON. The curated record marks active exploitation as yes, but no CVE identifier is present in the curated finding.

That lack of CVE detail matters. This is not yet a clean patch-ticket story. It is a monitoring and readiness story: confirm where BitLocker is a critical control, review high-value Windows assets, watch Microsoft channels for identifiers or mitigations, and prepare endpoint teams to act once official guidance lands.

Finding: PAN-OS CVE-2026-0264 exposes critical unauthenticated RCE risk

Confidence: High

Palo Alto Networks is the source for CVE-2026-0264, a heap-based buffer overflow in PAN-OS DNS Proxy and DNS Server components. The curated record lists CVSS 9.8 and describes the possible impact as unauthenticated remote code execution. Active exploitation is marked no in the source data.

Even without exploitation reporting, this needs fast exposure work. Check internet-facing or high-trust PAN-OS appliances first, especially where DNS Proxy or DNS Server functions are enabled. Patch planning should sit with the network security owners, not only the generic vulnerability-management queue.

Finding: PAN-OS CVE-2026-0258 adds SSRF exposure in IKEv2 certificate URL fetching

Confidence: Medium

Palo Alto Networks also disclosed CVE-2026-0258, a server-side request forgery issue in PAN-OS IKEv2 certificate URL fetching. The curated record lists CVSS 6.5 and no active exploitation.

This is lower priority than CVE-2026-0264, but it belongs in the same PAN-OS review cycle. Teams should confirm affected versions, look at IKEv2 certificate handling and align remediation with the critical RCE update where possible.

Finding: PAN-OS CVE-2026-0256 is a web-interface stored XSS issue

Confidence: Medium

CVE-2026-0256 is a stored cross-site scripting vulnerability in the PAN-OS web interface. The curated record lists CVSS 6.1 and no active exploitation.

The practical control remains familiar: restrict management-plane access, patch affected versions and avoid exposing administrative interfaces to broad networks. It should not displace CVE-2026-0264, but it should be included in the same change window if the affected estate overlaps.

Finding: Siemens SIMATIC CVE-2024-47704 needs OT owner review

Confidence: Low

CISA published an ICS advisory for Siemens SIMATIC, including CVE-2024-47704. The curated record marks this finding low confidence because the curated brief contains limited detail on affected versions and impact.

That does not make the advisory unimportant. It means OT and engineering owners should validate applicability against deployed Siemens SIMATIC assets before security teams assign severity. Treat this as an exposure-discovery task, then escalate if affected production systems are found.

Finding: Siemens Simcenter Femap CVE-2025-12659 needs engineering-software validation

Confidence: Low

CISA also published an advisory for Siemens Simcenter Femap, including CVE-2025-12659. The source detail in the curated brief is limited, so confidence remains low.

Organisations using Simcenter Femap should check installed versions and vendor guidance. If the software is used in sensitive engineering workflows, confirm whether the issue affects file handling, project integrity or workstation exposure before setting remediation priority.

Update: OPNsense WID-SEC-2026-1344 remains in the firewall patch queue

Confidence: Medium

BSI CERT-Bund updated WID-SEC-2026-1344 for multiple OPNsense vulnerabilities, including CVE-2026-44193 and CVE-2026-44195. The curated record marks active exploitation as no.

Keep OPNsense in the network security patch queue, with priority for internet-facing gateways and environments where firewall downtime would affect incident response. The advisory is not today’s lead because there is no exploitation signal in the source data, but it is still relevant operational work.

Why This Matters

Today’s change is not one story. It is three parallel pressure points. CISA KEV means CVE-2026-20182 has exploitation evidence and needs immediate triage. The Windows item lacks CVEs, so it needs monitoring discipline rather than invented certainty. PAN-OS CVE-2026-0264 gives network teams a named, critical RCE to check now.

The useful split for clients is simple: exploited items first, critical exposed infrastructure second, and lower-confidence industrial advisories through owner validation.

• Recommended Actions
• Triage CVE-2026-20182 against CISA and vendor guidance, then assign exploited-vulnerability ownership.
• Monitor Microsoft channels for identifiers and mitigations tied to the BitLocker and CTFMON zero-days.
• Check PAN-OS exposure to CVE-2026-0264, especially DNS Proxy and DNS Server usage on high-trust or internet-facing appliances.
• Bundle PAN-OS CVE-2026-0258 and CVE-2026-0256 into the same affected-version review where possible.
• Validate Siemens SIMATIC and Simcenter Femap applicability with OT and engineering owners before escalating severity.
• Keep OPNsense WID-SEC-2026-1344 in the network patch queue, prioritised by exposure.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 15 May 2026.

Microsoft Bug Leaker and BitLocker Zero-Day Put Exploited Windows Issues Back on Watch

Finding: Mystery Microsoft bug leaker keeps the zero-days coming

Confidence: High

The 14 May source set cites The Register reporting that an anonymous source continues to disclose Microsoft zero-day vulnerabilities. The finding is marked high confidence and active exploitation is noted in the source data, but no CVE identifier is available in the brief.

That makes this a response-readiness issue rather than a normal patch-ticket item. Microsoft owners should watch for vendor identifiers, mitigation guidance and any product-specific detail that moves the issue from a broad zero-day warning into a concrete exposure check.

Finding: Windows BitLocker zero-day gives access to protected drives, PoC released

Confidence: High

The source set adds a BleepingComputer-sourced report on a Windows BitLocker zero-day with a public proof of concept. The source text says the issue can give access to protected drives and records active exploitation as yes. It does not include a CVE.

Treat BitLocker as a priority validation area today. Confirm where BitLocker is relied on as a compensating control, review configuration baselines and prepare to act quickly if Microsoft publishes formal mitigation or update guidance.

Finding: Prometheus Azure AD CVE-2026-42151 exposes OAuth client secrets through config API

Confidence: High

MSRC is the source for CVE-2026-42151, which The source material describes as a Prometheus Azure AD remote write issue that can expose OAuth client secrets through a configuration API. The source set records CVSS 7.5 and no active exploitation.

This is not the loudest story of the day, but it is the cleanest exposure check. Teams using Prometheus remote write with Azure AD integration should review affected deployments, protect stored secrets and apply available Microsoft guidance.

Update: Red Hat Advanced Cluster Management CVE-2026-29063 remains in the Kubernetes queue

Confidence: Medium

The source set lists BSI CERT-Bund WID-SEC-2026-1367 as an updated advisory for Red Hat Advanced Cluster Management and Multicluster engine for Kubernetes. The brief associates CVE-2026-29063 with possible code execution or denial of service and marks active exploitation as no.

Keep this in the Kubernetes platform maintenance queue. Prioritise internet-reachable or high-trust management planes, but do not let it displace today's actively exploited Microsoft zero-day watchpoints.

Finding: Oracle Java SE WID-SEC-2025-1569 is no longer active in the curated list

Confidence: Medium

The source set marks Oracle Java SE WID-SEC-2025-1569 as resolved because it is no longer active in the curated list or threat tracker. That is a publishing signal, not proof that every estate has completed remediation.

Leave any local Oracle Java patch obligations in normal asset and vulnerability-management workflows. For today's client brief, it drops out of the active threat narrative.

Finding: GlobalProtect App CVE-2026-0251 adds local privilege-escalation work

Confidence: Medium

Palo Alto Networks is the source for CVE-2026-0251, which The source material describes as local privilege-escalation vulnerabilities in the GlobalProtect App. The source set records CVSS 6.5 and no active exploitation.

Endpoint teams should include GlobalProtect App versions in their patch checks. The risk is local elevation, so prioritise shared workstations, administrator endpoints and systems where VPN client compromise would meaningfully increase access.

Finding: PAN-OS CVE-2026-0261 allows authenticated admin command injection

Confidence: Medium

The source set adds Palo Alto Networks CVE-2026-0261 for PAN-OS authenticated admin command injection. The finding is medium confidence, CVSS 6.5 and has no active exploitation reported in the brief.

This is still important because administrative access to PAN-OS is sensitive by design. Restrict management-plane access, review administrator account hygiene and schedule the vendor update for affected appliances.

Finding: PAN-OS CVE-2026-0262 creates denial-of-service risk in traffic parsing

Confidence: Medium

Palo Alto Networks CVE-2026-0262 covers denial-of-service vulnerabilities in PAN-OS network traffic parsing. The source set records CVSS 6.5 and no active exploitation.

Network teams should treat this as resilience work. Patch planning should start with devices that handle critical traffic paths or sit at chokepoints where downtime would affect incident response, remote access or production operations.

Finding: GlobalProtect and PAN-OS CVE-2026-0257 authentication bypass needs exposure checks

Confidence: Medium

The source set lists Palo Alto Networks CVE-2026-0257 for GlobalProtect and PAN-OS authentication bypass vulnerabilities. The source data marks it medium confidence, CVSS 6.5 and no active exploitation.

Even without exploitation reporting, authentication bypass belongs high in the Palo Alto review queue. Confirm affected versions, patch status and whether GlobalProtect portals or gateways are exposed to untrusted networks.

Update: Microsoft Edge CVE-2026-40416, CVE-2026-41107 and CVE-2026-42838 remain a browser patch item

Confidence: Medium

The source set records BSI CERT-Bund WID-SEC-2026-1425 as an updated Microsoft Edge advisory. The finding metadata names CVE-2026-40416, and the summary also references CVE-2026-41107 and CVE-2026-42838. No active exploitation is reported.

This should move through standard browser update channels. Give priority to managed environments where Edge is used for privileged portals, cloud administration or sensitive internal applications.

Why This Matters

The main change from yesterday is urgency. Yesterday's Microsoft story was a broad Patch Tuesday queue. Today's lead is a pair of active zero-day watchpoints, one tied to BitLocker and another tied to further anonymous Microsoft disclosures.

There is also a practical split in the work. The Microsoft zero-day items need monitoring and mitigation readiness because The source material does not provide CVEs. Prometheus CVE-2026-42151 and the Palo Alto Networks CVEs are more conventional exposure and patch checks.

• Recommended Actions
• Monitor Microsoft channels for identifiers and guidance tied to the anonymous zero-day disclosures and the BitLocker proof of concept.
• Review BitLocker configurations and note systems where drive protection is a critical control.
• Check Prometheus Azure AD remote write deployments for CVE-2026-42151 exposure and protect OAuth client secrets.
• Keep Red Hat Advanced Cluster Management CVE-2026-29063 in the Kubernetes platform patch queue.
• Patch or schedule Palo Alto Networks PAN-OS and GlobalProtect items, especially CVE-2026-0257 and CVE-2026-0261.
• Continue standard Microsoft Edge update coverage for CVE-2026-40416, CVE-2026-41107 and CVE-2026-42838.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 14 May 2026.

Ivanti Active Exploitation Leads 11 May Security Brief

Finding: CISA mandates patching for actively exploited Ivanti flaw

Confidence: High

CISA has directed federal agencies to patch an Ivanti vulnerability that the available source set describes as actively exploited as a zero-day. The available source is BleepingComputer reporting on the CISA directive, and today’s brief does not provide a specific CVE for this item.

That missing CVE matters. Security teams should not invent one or assume the issue maps to a known bulletin without checking their Ivanti estate. The right move is to identify deployed Ivanti products, compare them with CISA and vendor guidance, and prioritise any affected internet-facing systems.

Finding: Go runtime and tooling advisories add development-platform risk

Confidence: Medium

today’s source set adds a cluster of Go-related vulnerabilities from MSRC: CVE-2026-39836, CVE-2026-33811, CVE-2026-42499, CVE-2026-39820, CVE-2026-41889 and CVE-2026-42501. The reported issues span panic or crash conditions, quadratic string concatenation in net/mail, SQL injection in pgx and a malicious module proxy bypass.

This is not a single perimeter patch. It is an engineering exposure question. Organisations should identify Go services, CI images, module dependencies and developer workstations, then decide where patched toolchains or dependency updates are needed first.

Update: Microsoft Azure DevOps CVE-2026-42826 remains in triage

Confidence: High

Previously covered 2026-05-10; today's delta: the independent review matched this advisory to prior publication, so it is an UPDATED DevOps-platform exposure item rather than a new finding.

BSI CERT-Bund WID-SEC-2026-1414 tracks CVE-2026-42826 as an information disclosure vulnerability in Microsoft Azure DevOps. the available source data does not provide an explicit CVSS score. Azure DevOps owners should review the advisory, confirm whether their environment is affected, and check whether project data, pipeline metadata or build-related information could be exposed.

Finding: Vim CVE-2026-44656 needs baseline review

Confidence: Medium

MSRC lists CVE-2026-44656 as an OS command injection vulnerability in Vim via path completion. today’s brief treats this as a new finding and does not include active-exploitation evidence.

The practical response is inventory-led. Vim is often present on servers, developer systems and administrative workstations, including places where it is rarely thought of as a front-line application. Platform teams should confirm where Vim is installed and apply vendor or distribution fixes as they become available.

Update: Node.js WID-SEC-2026-0843 remains a multi-CVE patch item

Confidence: High

today’s source set marks Node.js WID-SEC-2026-0843 as UPDATED. It includes CVE-2024-36137, CVE-2026-21637 and other vulnerabilities, but the available source data does not provide specific CVSS scores for each CVE.

That makes version control more useful than severity language. Application owners should inventory Node.js runtimes across production, CI and build systems, then update supported branches in line with the advisory.

Why This Matters

The important change today is prioritisation. Ivanti has active-exploitation urgency. Go and Vim add new engineering work. Azure DevOps and Node.js remain important, but they should be handled as updates with the limits of the source data made clear.

This separation helps teams avoid two bad outcomes: missing an actively exploited product family, or treating every advisory in the same emergency lane.

• Recommended Actions
• Identify Ivanti deployments immediately and compare them with current CISA and vendor guidance.
• Assess Go applications, build images and module dependencies for the six CVEs named in today’s brief.
• Review Vim exposure for CVE-2026-44656 and patch through vendor or distribution channels.
• Keep Azure DevOps CVE-2026-42826 in triage as an updated information disclosure advisory.
• Update Node.js runtimes covered by WID-SEC-2026-0843, prioritising exposed services and CI systems.
• Do not assign CVSS scores or CVE IDs where the available source data did not provide them.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 11 May 2026.

MetInfo CMS CVE-2026-29014 Exploitation Report Leads Today’s Risk Queue

Finding: MetInfo CMS CVE-2026-29014 has reported active exploitation

Confidence: High

The Hacker News, citing VulnCheck findings, reports active exploitation of MetInfo CMS CVE-2026-29014, a remote code execution vulnerability listed with CVSS 9.8 in the daily packet. That source-qualified exploitation report changes the operational priority, even though the source set classifies the finding as unchanged.

This is not a broad “everything is on fire” signal. It is a focused web-application remediation item. Teams that run MetInfo CMS should verify version exposure, apply the relevant fix path, and check whether internet-facing instances have signs of suspicious activity.

Stable / watching: cPanel/WHM CVE-2026-29201 remains a high-severity hosting patch item

Confidence: High

The available material keeps cPanel/WHM in the watchlist with fixes released for three vulnerabilities, including CVE-2026-29201 and CVSS 9.0. The source data does not state active exploitation, so this should not be handled the same way as MetInfo CMS.

For hosting providers and organisations that manage shared web estates, the practical step is simple: confirm whether cPanel or WHM is deployed, identify the maintenance window, and verify that fixed versions have been applied.

Stable / watching: Firewalld CVE-2026-4948 needs local privilege review

Confidence: Medium

CVE-2026-4948 remains in the unchanged set as a Firewalld issue where a local unprivileged user can modify firewall state due to D-Bus setter mis-authorisation. That makes it a host hardening and privilege-boundary concern rather than an internet-scale exploitation headline in the available evidence.

Linux platform teams should map Firewalld usage, confirm distribution-level updates, and treat exposed multi-user systems as higher priority than tightly controlled single-purpose hosts.

Stable / watching: Gnutls CVE-2026-3832 affects certificate trust decisions

Confidence: Medium

The source set continues to track CVE-2026-3832 as a Gnutls security bypass where a crafted OCSP response may allow revoked server certificates to be accepted. The available material does not add exploitation evidence, but the security impact is still important for systems that rely on Gnutls for TLS validation.

This belongs with platform and application owners who manage Linux libraries, package baselines and certificate-validation paths. Update planning should prioritise systems where revoked-certificate handling is security-critical.

Stable / watching: KDE KCoreAddons CVE-2026-41526 remains on the remediation watchlist

Confidence: Medium

NVD identifies CVE-2026-41526 as a KDE KCoreAddons issue involving KShell::quoteArgs handling of shell metacharacters. The available material does not provide active-exploitation evidence or named victims.

Linux desktop and application owners should check whether KDE KCoreAddons is present in supported baselines, follow distribution or upstream KDE guidance, and avoid inflating severity beyond the evidence.

Finding: Microsoft Azure DevOps CVE-2026-42826 is today’s new advisory

Confidence: High

The only NEW finding in the 10 May source set is Microsoft Azure DevOps CVE-2026-42826, described by BSI CERT-Bund WID-SEC-2026-1414 as an information disclosure vulnerability. The available source data does not provide an explicit CVSS score.

Azure DevOps often sits close to code, pipelines, artefacts and deployment credentials. Owners should confirm whether the advisory applies to their environment, review Microsoft guidance, and check whether sensitive project data or build metadata could be exposed under the affected conditions.

Finding: Node.js WID-SEC-2026-0843 updates a multi-CVE advisory

Confidence: High

The source set marks Node.js WID-SEC-2026-0843 as UPDATED. The advisory covers CVE-2024-36137, CVE-2026-21637, CVE-2026-21710, CVE-2026-21711, CVE-2026-21712, CVE-2026-21713, CVE-2026-21714, CVE-2026-21715, CVE-2026-21716 and CVE-2026-21717.

The source data does not include specific CVSS scores for each Node.js CVE, so the right response is version-led rather than rhetoric-led. Application owners should inventory Node.js runtimes, identify exposed services and CI/CD dependencies, then update to supported patched releases.

Why This Matters

Today’s useful change is priority. Yesterday’s story was a broad patch queue. Today’s story separates a source-qualified MetInfo CMS exploitation report from a new Azure DevOps disclosure advisory, an updated Node.js package of CVEs, and several unchanged watchlist items.

That separation prevents two mistakes: treating every advisory like an emergency, or missing the one item with a credible exploitation report.

• Recommended Actions
• Patch or remove exposed MetInfo CMS instances affected by CVE-2026-29014, then check for suspicious activity.
• Review Microsoft Azure DevOps exposure for CVE-2026-42826 and follow Microsoft or BSI guidance.
• Inventory Node.js runtimes and update affected branches covered by WID-SEC-2026-0843.
• Keep cPanel/WHM CVE-2026-29201, Firewalld CVE-2026-4948, Gnutls CVE-2026-3832 and KDE KCoreAddons CVE-2026-41526 on the remediation board.
• Do not assign emergency severity to items where the available source material lacks exploitation evidence.

All findings grounded in a13e intelligence sweeps through 05:30 UTC 10 May 2026.

Palo Alto Networks PAN-OS CVE-2026-0300 — Exposed Captive Portals Face Critical RCE Risk

Finding: CVE-2026-0300 exposes PAN-OS User-ID Authentication Portals to unauthenticated RCE

Confidence: High

Palo Alto Networks’ advisory for CVE-2026-0300 describes a buffer overflow in the PAN-OS User-ID™ Authentication Portal, also known as Captive Portal. The vendor states that a remote unauthenticated attacker can execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets.

NHS England alert CC-4777 independently summarises the issue as unauthenticated remote code execution with root privileges on exposed Palo Alto PAN-OS firewalls. Palo Alto assigns CVSS v4.0 9.3 Critical severity and marks exploit maturity as attacked. This moves the item beyond a thin advisory queue and into immediate exposure triage.

Exploitation is limited, but exposed portals are the urgent risk boundary

Confidence: High

Palo Alto reports limited exploitation targeting User-ID Authentication Portals exposed to untrusted IP addresses or the public internet. NHS England states that Palo Alto is aware of limited in-the-wild exploitation and that NHS England National CSOC assesses further exploitation as highly likely.

The operational distinction matters. This is not a generic “all PAN-OS devices are equally exposed” story. The highest-risk condition is a PA-Series or VM-Series firewall configured to use User-ID Authentication Portal with response pages enabled on an interface reachable from untrusted or internet traffic.

Affected branches are PAN-OS 12.1, 11.2, 11.1, and 10.2 under specific portal exposure conditions

Confidence: High

Palo Alto lists affected PAN-OS release lines across 12.1, 11.2, 11.1, and 10.2, with fixed releases pending across multiple maintenance branches. The advisory states that Prisma Access, Cloud NGFW, and Panorama appliances are not impacted.

Affected organisations should verify both software branch and configuration. The exposure condition requires User-ID Authentication Portal to be enabled and an interface management profile with response pages enabled on an external or internet-accessible interface. Version checks alone are not enough if the portal remains reachable from untrusted networks.

Mitigation is available before patches land

Confidence: High

Palo Alto says fixes are planned in upcoming PAN-OS releases, with fixed-version ETAs listed for 13 May and 28 May 2026 depending on branch and maintenance line. NHS England similarly says patches are expected on 13 May and 28 May and strongly encourages affected organisations to apply them when released.

Until those patches are available, the control is configuration. Disable User-ID Authentication Portal if it is not required. If it is required, restrict access to trusted zones or trusted internal IP addresses and disable response pages on external Layer 3 interfaces where untrusted or internet traffic can ingress. Palo Alto also notes that customers with Threat Prevention can block attacks by enabling Threat ID 510019 from Applications and Threats content version 9097-10022, with PAN-OS 11.1 or later required for that Threat ID support.

Queue hygiene note: the 04:33 a13e review changes the low-confidence queue

Confidence: High

The earlier 03:25 daily brief predated the 2026-05-07 04:33 a13e review. That later review records that the previous BSI WID set, including WID-SEC-2026-1366, 1383, 1379, 1363, 1381, 1377, 1380, and 1370, was already excluded or ledgered. Those items should not be presented as the freshest queue without that caveat.

The 04:33 a13e review instead promotes six newer low-confidence inventory items: Keycloak WID-SEC-2026-1330, Asterisk/pjproject WID-SEC-2026-1378, Dell BIOS WID-SEC-2026-1382, Django WID-SEC-2026-1373, MinIO WID-SEC-2026-1376, and Kernel WID-SEC-2026-1385. the 04:33 review rates all six as LOW confidence / UNVERIFIED single-source BSI advisories with no confirmed active exploitation, IOCs, or named victims in the available corpus.

Why This Matters

CVE-2026-0300 combines three traits that should trigger fast action: exposed edge infrastructure, unauthenticated remote code execution, and root-level impact. The existence of limited exploitation means teams should not wait for patch availability before reducing exposure.

The rest of the day’s queue is different. Keycloak, Asterisk/pjproject, Dell BIOS, Django, MinIO, and Kernel entries are useful inventory prompts, not emergency findings. Treating those low-confidence BSI items with the same urgency as CVE-2026-0300 would blur the response priority.

• Recommended Actions
• Identify PA-Series and VM-Series firewalls running PAN-OS 12.1, 11.2, 11.1, or 10.2.
• Check whether User-ID Authentication Portal/Captive Portal is enabled.
• Confirm whether response pages are enabled on any external or internet-accessible Layer 3 interface.
• Disable User-ID Authentication Portal where it is not required.
• Where the portal is required, restrict access to trusted zones or trusted internal IP addresses and remove response-page exposure from untrusted ingress paths.
• Track Palo Alto fixed releases expected on 13 May and 28 May 2026 and schedule branch-appropriate patching when available.

All findings grounded in a13e intelligence sweeps through 04:33 UTC 07 May 2026.

MOVEit Automation CVE-2026-4670, Critical Authentication Bypass Leads a Fresh Patch Queue

Finding: MOVEit Automation authentication bypass, CVE-2026-4670

Confidence: Medium

Progress MOVEit Automation versions before 2025.1.5, 2025.0.9, and 2024.1.8 are affected by a critical authentication bypass tracked as CVE-2026-4670 and WID-SEC-2026-1336. BSI CERT-Bund lists the advisory, and BleepingComputer reports the fixed version branches, giving this item enough corroboration to lead today’s public content.

The risk is straightforward: managed file transfer automation often sits close to sensitive data flows, partner connectivity, and scheduled operational jobs. Internet-facing MOVEit Automation nodes should be treated as the first inventory target, followed by internal systems with privileged automation workflows.

Update: Linux Copy Fail active exploitation confirmed, CVE-2026-31431

Confidence: High

CISA has added Linux Copy Fail, CVE-2026-31431, to the Known Exploited Vulnerabilities Catalog with a remediation due date of 2026-05-15. BleepingComputer also reports exploitation activity, which changes the posture from local privilege-escalation exposure to active exploitation pressure.

This is an update rather than a new finding, but it is the most urgent operational item in today’s evidence. Linux estate owners should identify affected kernels, prioritise internet-facing and high-value systems, and align remediation to the CISA KEV deadline.

Finding: Ubuntu Exim CVE-2026-40685 and curl CVE-2026-4873 fixes

Confidence: Medium

Ubuntu USN-8228-1 fixes Exim issues including CVE-2026-40685, described in the source material as malformed JSON header parsing that could lead to arbitrary code execution and information disclosure. Mail relays and exposed Exim hosts deserve early attention because mail infrastructure often has broad reach and uneven maintenance windows.

Ubuntu USN-8227-1 fixes curl connection-reuse issues including CVE-2026-4873, CVE-2026-5545, and CVE-2026-5773. The main concern is sensitive-information exposure in workloads that use curl or libcurl for authenticated service-to-service requests.

Finding: BSI advisories widen the watch list

Confidence: Low

BSI CERT-Bund lists new advisories for Rancher, D-LINK M60, OPNsense, IBM Langflow, Qt, Langflow, Keycloak, FreeBSD, GnuTLS, Wireshark, vm2, and Bitwarden CLI. These are useful watch signals, but many currently have limited readable detail and should not be overstated without vendor confirmation, CVE mapping, or affected-version detail.

The practical move is not panic patching. Build an owner-mapped inventory for Rancher, OPNsense, D-LINK M60, Keycloak, Langflow, and Qt-bearing applications, then enrich each advisory against vendor pages before raising customer-specific severity.

Why This Matters

Today’s change is quality, not volume. The MOVEit Automation item gives security teams a specific new critical application to check, and the Linux Copy Fail KEV listing gives patch teams a dated exploitation-driven deadline.

The broader BSI set matters because it touches control-plane software, perimeter devices, identity, developer tools, and application runtimes. Most of those items still need enrichment, but they are good triggers for asset discovery now.

• Recommended Actions
• Upgrade MOVEit Automation to 2025.1.5, 2025.0.9, or 2024.1.8 or later, starting with internet-facing automation nodes.
• Inventory Linux kernels for CVE-2026-31431 exposure and schedule remediation before the 2026-05-15 CISA KEV due date.
• Patch Ubuntu Exim and curl packages where deployed, especially mail relays and systems using authenticated curl/libcurl requests.
• Inventory Rancher, OPNsense, D-LINK M60, Keycloak, Langflow, and Qt-bearing applications, then restrict exposed admin surfaces.
• Enrich low-confidence BSI WID advisories with vendor references, affected versions, and CVE mappings before escalating severity.

All findings grounded in a13e intelligence sweeps through 03:25 UTC 05 May 2026.