
Threat Roundup May 18 2026: Palo Alto RCE, Exchange KEV
Weekly cybersecurity threat roundup May 18: Palo Alto root RCE, Exchange CISA KEV, Linux privesc, and 275M Canvas breach demand Monday action.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Win an All Access InfoSec World 2026 pass, valued at $3,895.
Win a $3,895 InfoSec World 2026 pass.
7 results tagged privilege escalation

Weekly cybersecurity threat roundup May 18: Palo Alto root RCE, Exchange CISA KEV, Linux privesc, and 275M Canvas breach demand Monday action.

CVE-2023-20198 is a critical unauthenticated privilege escalation vulnerability in Cisco IOS XE software's web UI feature. Exploited as a zero-day before Cisco published any advisory, attackers used it to create administrator accounts and then chained it with CVE-2023-20273 to deploy a persistent Lua-based implant on over 50,000 network devices. No authentication or user interaction required.

CVE-2022-26923 (Certifried) is a privilege escalation vulnerability in Active Directory Certificate Services (AD CS) patched in May 2022. A domain user with the ability to create or modify machine accounts can request a certificate that impersonates a Domain Controller, then use that certificate in a Kerberos PKINIT authentication to obtain a TGT with domain admin-equivalent privileges. CVSS 8.8.

CVE-2022-0847, named Dirty Pipe, is a Linux kernel vulnerability allowing any unprivileged local user to write to arbitrary read-only files and achieve root privilege escalation. Unlike the 2016 Dirty Cow vulnerability it resembles, Dirty Pipe requires no race condition, it is deterministic and reliable. Affects Linux kernels 5.8 through 5.16.10 and was quickly weaponized for container escapes and Android rooting.

CVE-2021-4034, named PwnKit by Qualys, is an out-of-bounds write vulnerability in pkexec, a SUID-root binary part of the polkit framework installed by default on virtually every Linux distribution. Any local unprivileged user can exploit it to gain root without any sudo permissions, without knowing any password, and without triggering standard auth log entries. Present since May 2009.

CVE-2021-42287 and CVE-2021-42278 are Active Directory privilege escalation vulnerabilities patched in November 2021. Chained together in the 'noPac' exploit, they allowed any authenticated domain user to impersonate a Domain Controller via Kerberos, obtaining a TGT with domain admin-equivalent privileges, a complete Active Directory takeover from a standard user account with no additional tooling beyond a domain login.

CVE-2021-3156, named Baron Samedit, is a heap-based buffer overflow in the sudo utility that allows any unprivileged local user to gain root privileges without authentication, without being listed in the sudoers file, and without any race condition. Present in sudo for nearly 10 years, it affects every major Linux distribution. Qualys developed working exploits for Ubuntu 20.04, 18.04, Debian 10, and Fedora 33 default installations.