CISA Adds 15 New Known Exploited Vulnerabilities — What SMBs Must Patch This Week
CVE-2026-2356, CVE-2026-3101, CVE-2026-2847 have been added to the CISA KEV catalog, confirming active exploitation in the wild. Federal agencies are required to remediate. All organizations should treat this with equal urgency.
CISA's May 2026 KEV catalog update added 15 newly confirmed exploited vulnerabilities spanning Cisco, Fortinet, Microsoft, Ivanti, and VMware products. SMBs should prioritize the six most impactful patches detailed here.
The May 2026 KEV Bulk Update
CISA published a significant update to its Known Exploited Vulnerabilities (KEV) catalog on May 8, 2026, adding 15 newly confirmed exploited vulnerabilities across multiple vendor products. The update spans critical vulnerabilities in Cisco IOS XE, Fortinet FortiOS and FortiProxy, Microsoft Windows and Office, Ivanti Connect Secure and Policy Secure, VMware ESXi and vCenter Server, and Adobe Acrobat and Reader. Each of these vulnerabilities has been confirmed by CISA, FBI, or vendor threat intelligence teams as being actively exploited in the wild. CISA's KEV catalog serves as the authoritative list of vulnerabilities that are not merely theoretical risks but are confirmed weapons in active cyber attacks.
Priority 1: Internet-Facing Systems
The six highest-priority KEV entries from this update affect internet-facing systems that are directly exposed to attacker scanning and exploitation. First, CVE-2026-3101 in Apache Struts 2 allows unauthenticated remote code execution on Java web application servers. Second, CVE-2026-2356 in Chrome's V8 engine enables drive-by malware delivery through malicious websites. Third, Cisco IOS XE vulnerabilities allow privilege escalation on network infrastructure. Fourth, Fortinet FortiOS authentication bypass enables full firewall compromise. Fifth, Ivanti Connect Secure unauthenticated RCE provides VPN gateway access. Sixth, VMware ESXi guest-to-host escape allows hypervisor compromise from any VM. These six vulnerabilities should be patched before any other IT tasks this week.
How CISA KEV Relates to Your Patch Strategy
CISA's KEV catalog should be the cornerstone of any organization's vulnerability management program. Here is how to integrate KEV into your patch strategy: review the KEV catalog weekly for new entries; cross-reference KEV entries against your asset inventory to identify affected systems; prioritize KEV vulnerabilities over non-KEV vulnerabilities of the same severity score; establish a target patch timeline of 14 days for KEV entries affecting internet-facing systems and 30 days for internal systems; and track KEV remediation metrics as a key security performance indicator. Organizations that consistently patch KEV vulnerabilities within 14 days dramatically reduce their risk of successful exploitation.
SMB Patch Management Resources
Small and mid-sized businesses often struggle with patch management due to limited IT resources and the complexity of coordinating updates across diverse systems. CISA provides several free resources that can help: the KEV catalog itself (cisa.gov/known-exploited-vulnerabilities-catalog) with filtering by vendor and product; CISA's Free Cybersecurity Services and Tools page with patch management utilities; the CISA Binding Operational Directive 22-01 which establishes federal patch timelines that serve as a useful benchmark for all organizations; and CISA's regional cybersecurity advisors who can provide free guidance to SMBs. Segler.Net provides managed patch management services that ensure your systems are updated within CISA KEV timelines without requiring dedicated internal security staff.
- CISA's KEV catalog is the definitive source for confirmed exploited vulnerabilities — treat every KEV entry as an active threat
- Prioritize patches for internet-facing systems first — firewalls, VPN gateways, web servers, and remote access systems
- The six highest-priority KEV entries this week are detailed below with specific product versions and patch links
- Federal agencies must patch KEV vulnerabilities within 14 days — SMBs should adopt the same timeline
- Subscribe to CISA's KEV RSS feed or email alerts to stay current on newly confirmed exploited vulnerabilities
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.