DFIRLab
All Briefings
weeklyMay 12, 2026 — May 18, 2026Published 07:00 UTC

Weekly Threat Briefing — 2026-05-12 to 2026-05-18

24 findings9 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
724 CVEs5,500 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 22
Browse all 24 findings

Executive summary · as of 07:00 UTC

The situation

The period of May 12-18, 2026 shows a critical security landscape requiring immediate attention. Two significant zero-day vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog: an authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20182) granting administrative access, and a cross-site scripting flaw in Microsoft Exchange Server (CVE-2026-42897). The threat environment is dominated by persistent Mozi botnet activity with 40+ malware distribution URLs actively distributing IoT malware, alongside emerging ClearFake campaigns.

Browse the full briefing

24 findings · 9 sections
Findings by severity
  • 4 critical
  • 18 high
  • 1 medium
  • 1 info
Vulnerabilities1 critical · 1 high

Critical Zero-Day Vulnerabilities - CISA KEV

Two critical vulnerabilities added to CISA Known Exploited Vulnerabilities catalog requiring immediate remediation

Vulnerabilities3 critical

Critical Remote Code Execution Vulnerabilities

Multiple critical-severity vulnerabilities enabling unauthenticated remote code execution across enterprise platforms

Vulnerabilities3 high

High-Severity SQL Injection and Authentication Flaws

Multiple SQL injection vulnerabilities and authentication bypasses affecting enterprise and web applications

Vulnerabilities3 high

Path Traversal and Arbitrary File Operations

Multiple path traversal vulnerabilities enabling unauthorized file access and deletion across web applications

Vulnerabilities3 high

Server-Side Request Forgery and Deserialization Flaws

SSRF and deserialization vulnerabilities enabling internal network access and remote code execution

Vulnerabilities3 high

Buffer Overflow and Memory Corruption Vulnerabilities

Local buffer overflow vulnerabilities in legacy applications enabling code execution

Malware2 high · 1 medium

Mozi Botnet Infrastructure Campaign

Extensive Mozi botnet activity targeting IoT devices with 40+ active malware distribution URLs

Tools & Techniques3 high

Attack Techniques and TTPs

Analysis of prevalent attack techniques observed in vulnerability exploitation and malware campaigns

  • High severity
    Exploitation of Public-Facing Applications (T1190)

    Dominant technique across 20+ vulnerabilities including authentication bypasses, SQL injection, and RCE flaws. Attackers targeting internet-facing enterprise systems (Exchange, SD-WAN, CMS platforms) and IoT devices with unauthenticated exploits.

    Source: Manual
  • High severity
    Command and Scripting Interpreter Exploitation

    Multiple vulnerabilities enable command injection and script execution via PowerShell (T1059.001), Unix shells (T1059.004), and JavaScript (T1059.007). ACL Analytics vulnerability specifically leverages EXECUTE function for PowerShell payload delivery.

    Source: Manual
  • High severity
    Bootloader and Pre-OS Boot Persistence

    Das U-Boot signature verification bypass (CVE-2026-46728) enables firmware-level persistence through FIT image manipulation. Represents advanced supply chain and persistence technique targeting embedded systems.

    Source: Manual
DFIR Lab1 info

Detection and Analysis Resources

Published research and tools for threat detection and analysis

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.