【Vulnerability Alert】CISA Added 2 Known Exploited Vulnerabilities to the KEV Catalog (2026/05/11-2026/05/17)

publish date : 2026-05-22 update date : 2026-05-22

Source: Ministry of education information & communication security contingency platform

"" "" ""


Publication Number	TACERT-ANA-2026051910053939	Publication Time	2026-05-19 10:21:39
Incident Type	ANA-Vulnerability Alert	Discovery Time	2026-05-19 10:21:39
Impact Level	Low
[Subject] 【Vulnerability Alert】CISA Added 2 Known Exploited Vulnerabilities to the KEV Catalog (2026/05/11-2026/05/17)
[Content] Forwarded from TWCERTCC Information Security Alert TWCERTCC-200-202605-00000012 【CVE-2026-20182】Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (CVSS v3.1: 10.0) 【Whether exploited by ransomware: Unknown】Cisco Catalyst SD-WAN Controller & Manager has an authentication bypass vulnerability. An unauthenticated remote attacker may exploit this vulnerability to bypass authentication and obtain administrator privileges on the affected system. 【CVE-2026-42897】Microsoft Exchange Server Cross-Site Scripting Vulnerability (CVSS v3.1: 8.1) 【Whether exploited by ransomware: Unknown】Microsoft Exchange Server has a cross-site scripting vulnerability when Outlook Web Access generates webpages. Under specific interaction conditions, an attacker may execute arbitrary JavaScript code in the browser environment. Information sharing level: WHITE (the intelligence content is information that can be publicly disclosed)
[Affected Platform] 【CVE-2026-20182】Please refer to the affected versions listed by the official source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW 【CVE-2026-42897】Please refer to the affected versions listed by the official source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
[Recommended Actions] 【CVE-2026-20182】The official source has released a fix update for the vulnerability. Please update to the relevant version: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW 【CVE-2026-42897】The official source has released a fix update for the vulnerability. Please update to the relevant version: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
[Reference]

(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw

Organizer: Computer Center

Click Num:

Share