Three Critical Vulnerabilities You May Have Missed in May

If you don’t spend your day reading cybersecurity feeds, you missed a busy month. May 2026 brought four developments that any business owner should know about, not because you need to become a vulnerability researcher, but because each one changes the math on what your IT team or your IT provider should be doing right now.

Here’s the plain-English version of what happened, why it matters to small and mid-sized businesses specifically, and what to actually do about it.

1. On-premises Microsoft Exchange: Outlook on the web flaw exploited via crafted email

The headline: A new vulnerability in on-premises Microsoft Exchange, tracked as CVE-2026-42897, is being actively exploited and has been added to CISA’s Known Exploited Vulnerabilities catalog. It’s a cross-site scripting and spoofing flaw in Outlook on the web (the browser version of Outlook that on-prem Exchange serves). The attack arrives as a specially crafted email, and the trap springs when a user opens the message in Outlook on the web: the attacker’s script runs inside the user’s browser session, letting the attacker act as that user — reading mail, sending mail, spoofing content — without ever touching a password. No attachment, no download, no obviously suspicious link. Microsoft rates it 8.1 out of 10, and given confirmed exploitation in the wild, treat that score as a floor, not a ceiling.

Why it matters to SMBs: Most small and mid-sized businesses moved their email to Microsoft 365 years ago, but on-premises Exchange is still alive in three places we keep finding it:

• Hybrid environments where a small Exchange server was left behind after a cloud migration to handle account provisioning. Microsoft has been telling people to remove these for years. Most never did.
• Industries with regulatory or compliance requirements that pushed them to keep mail on their own hardware. Legal, healthcare, and a few specialized financial verticals are common holdouts.
• Old enough environments that nobody on the current team remembers Exchange is still running. We’ve walked into client sites where the on-prem server has been quietly humming in a closet for years, forwarding mail to M365 but still receiving inbound messages from the internet.

If any of those describe you, this vulnerability is your problem until proven otherwise.

What to do:

• Confirm whether any version of Exchange is still running anywhere in your environment. If you have outsourced IT, ask the question explicitly. “Do we have any on-prem Exchange servers, including hybrid configuration servers, anywhere in our network?”
• If yes, apply Microsoft’s patch immediately. Not next maintenance window. This week.
• If you can’t patch immediately, restrict inbound mail flow at the perimeter, isolate the server, or take it offline until it’s patched — and consider limiting Outlook on the web access in the meantime, since that’s where the exploit fires.
• If you have a hybrid Exchange server you don’t actually need anymore, this is the prompt to finally retire it. Microsoft publishes a documented decommissioning path. Talk to whoever runs your M365 about getting that scheduled.

2. Cisco Catalyst SD-WAN controller authentication bypass added to CISA’s emergency list

The headline: CVE-2026-20182 is an authentication bypass in Cisco Catalyst SD-WAN controllers. CISA added it to the Known Exploited Vulnerabilities Catalog on May 14 with an aggressive federal remediation deadline. The flaw lets an attacker gain administrative access to the controller, which in a fully deployed SD-WAN means administrative access to the network fabric.

Why it matters to SMBs: Cisco SD-WAN is most common in mid-market and enterprise environments, not in 20-person businesses. But there are two ways this becomes your problem:

• You’re a larger SMB or a multi-site operation that runs Cisco SD-WAN as your wide-area network backbone. In that case this is critical infrastructure and needs immediate attention.
• You’re a smaller business that inherited or partnered into a network where Cisco SD-WAN is part of the upstream. We’ve seen this with franchise operations, joint ventures, and businesses that ride on a partner organization’s network.

CISA adds vulnerabilities to KEV only when there’s confirmed active exploitation in the wild. That’s the threshold. If it’s on KEV, criminals are using it today.

What to do:

• If you don’t run any Cisco SD-WAN equipment, you’re done with this one. Skip to the next.
• If you do, confirm with your network team or IT provider that the controller is on a patched version. The CISA advisory references Cisco’s specific guidance, including Emergency Directive 26-03, which has detailed remediation steps.
• Even after patching, run the hunt and hardening guidance CISA published alongside the directive. If exploitation already happened, patching closes the door but leaves the attacker inside. The hardening guidance is how you find out if you’ve been touched.

3. cPanel critical vulnerability weaponized against MSPs and hosting providers

The headline: CVE-2026-41940 is a critical vulnerability in cPanel and WHM, the control panel software that runs a large fraction of the world’s small business web hosting. European incident responders have confirmed it being used in ransomware campaigns, and it ranked among the most-sighted exploited vulnerabilities for two months running.

Why it matters to SMBs: Most small businesses don’t run cPanel themselves. They pay a web host that runs cPanel. The compromise happens at the host level, but the consequence lands on the customer. If your hosting provider’s cPanel installation gets compromised, the attacker may be able to access:

• Your website source code and any customer data stored alongside it
• Email accounts hosted on the same provider, including mailbox contents
• Database credentials and backups
• Any SSL certificates or API keys configured at the hosting level

Even if you’ve never touched the cPanel interface yourself, this attack still reaches you through your provider.

What to do:

• Ask your hosting provider directly whether they’ve patched CVE-2026-41940. A serious host will answer fast and clearly. A slow or evasive answer is a signal.
• If your website handles any customer data, including form submissions or e-commerce, ask whether your hosting provider has reviewed access logs for indicators of compromise since the vulnerability went public.
• If you can rotate passwords, API keys, and database credentials stored at the hosting level, do it. This is good hygiene any month and especially right after a major hosting vulnerability.
• For mission-critical sites, this is a reasonable trigger for a re-evaluation of whether your current hosting arrangement matches your security needs. Bargain-basement hosting and serious customer data are an increasingly bad combination.

4. “Mini Shai-Hulud” npm worm: 170+ packages compromised in a supply chain attack

The headline: Researchers identified a new wave of the self-spreading supply chain worm dubbed “Mini Shai-Hulud”, which compromised more than 170 packages across the npm and PyPI registries — collectively downloaded over 500 million times — including widely used libraries from TanStack, Mistral AI, and Guardrails AI. Downstream impact included a breach at Grafana Labs’ GitHub environment, which has published a postmortem. OpenAI separately published a response describing how they detected and contained their own exposure.

Why it matters to SMBs: npm is the package manager that powers most modern JavaScript and Node.js software. If your business has a custom web application, a mobile app with a JavaScript backend, an internal tool built by a contractor, or any kind of marketing site more complex than a static page, there’s a meaningful chance your supply chain includes npm packages.

The way these attacks work is that an attacker quietly injects malicious code into a popular package. Anyone who installs or updates that package downloads the malicious version along with everything else. The compromised code then steals credentials, secrets, or environment variables from the developer’s machine or the deployed environment.

You don’t have to be a software company for this to hit you. You just have to use software that other people built using these compromised packages.

What to do:

• If your business runs any custom software, ask your development team or your provider whether they’ve audited their dependencies against the published list of compromised packages. The lists are public and updated regularly as more packages are identified.
• Rotate any secrets that may have been exposed through development environments or CI/CD pipelines in the last month. Specifically: cloud provider API keys, database credentials, third-party service tokens, and any signing keys.
• Make sure your software providers, including your marketing agency if they built your website, have automated dependency scanning and have run a scan since the most recent wave of Mini Shai-Hulud disclosures.
• Long term, this is the prompt to require your software vendors to maintain a software bill of materials (SBOM) and to demonstrate their dependency monitoring practices. Vendor risk management used to mean asking about SOC 2. Now it also means asking about npm.

The pattern across all four

The four vulnerabilities above look different on the surface. Email servers, network controllers, hosting platforms, and JavaScript packages don’t have much in common. But the pattern is consistent.

Modern attacks are increasingly indirect. None of these are “a hacker phishes your CEO and steals her password.” They’re “a hacker compromises something your business depends on, and the consequence flows downhill to you.” Mail server you forgot you had. Hosting provider you barely think about. Software dependency three layers deep in a tool a contractor installed for you.

The defense is visibility, not paranoia. You don’t need to read every vulnerability advisory. You need to know what software, vendors, and dependencies your business actually runs, so that when the news cycle highlights one, you can answer “are we affected” in less than an hour.

The patching window keeps shrinking. “Critical” used to mean “patch in 30 days.” It now means “patch in 24 to 72 hours.” Anything actively exploited and on CISA KEV is closer to “patch today.” If your patch management cycle assumes monthly maintenance windows, that cycle is no longer fast enough for vulnerabilities at this severity.

What a serious patch and vulnerability management program looks like for SMBs

The good news is that you don’t need an enterprise security team to get this right. Here’s what we expect to see in any well-run small business in 2026:

• An accurate inventory of software, devices, and services. You can’t patch what you don’t know you have. We covered the foundational version of this in our IT security assessment checklist.
• Automated patching for endpoints and operating systems, with a documented exception process for systems that need a delay.
• Active monitoring of CISA KEV and major vendor advisories, with someone responsible for triaging within one business day.
• A vendor risk inventory that lists every third party with access to your data and every critical software dependency. Update it twice a year, not just when an auditor asks.
• A documented incident response plan that explicitly covers vulnerability-driven incidents, not just ransomware and phishing.

If you don’t have most of these, the right next step isn’t to panic. It’s to acknowledge the gap and start closing it methodically.

The bottom line

Four serious vulnerabilities. Three actively exploited in the wild. One supply chain attack with cascading impact. All in one month. None of it is dramatic enough to make the local news, but all of it is the new normal in 2026.

Your business doesn’t need to track every CVE. Your business does need to make sure someone competent is tracking them on your behalf, and that the loop between “new vulnerability published” and “we’ve assessed and acted” is measured in days, not weeks.

If you want a clear-eyed read on how your current setup would handle a month like this one, book an intro call — qualifying businesses receive our $2,500 IT Risk Assessment complimentary. We’ll walk through your software inventory, your patch cadence, your vendor exposure, and your incident response readiness, and give you a prioritized list of changes ranked by actual risk, not generic checklists.

The next critical vulnerability is already being researched somewhere. The work is making sure it doesn’t catch your business off guard when it lands.