High-Risk Vulnerabilities for May 2026: A Critical Overview

In May 2026, a total of 41 vulnerabilities were flagged as high-impact by the Insikt Group®, all receiving a Very Critical Recorded Future Risk Score. This represents an 11% uptick from the previous month, highlighting an escalating need for priority in remediation efforts across various sectors. As organizations increasingly rely on complex software systems, such statistics underline the growing threats they face from cybercriminals who are perpetually looking for exploitable weaknesses.

These vulnerabilities affected products from 20 different vendors, indicating a wide-reaching security concern. Notably, 21 of these vulnerabilities appear in the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. A further 19 were identified through honeypot data, while one was reported directly by a cybersecurity vendor, showcasing the multiple avenues through which security weaknesses are being exposed. This variety not only reflects vulnerabilities’ origins but also emphasizes the importance of an adaptive security posture across organizations.

Vulnerability Breakdown

Among the identified vulnerabilities, Vercel emerged as a significant player, accounting for about 27% of the total vulnerabilities identified. This uptick was primarily due to exploit activity sourced from honeypots related to Next.js, a popular framework among developers. The implications here are twofold: on one hand, it underscores the need for robust security measures around widely-used frameworks; on the other, it indicates the ease with which attackers can pivot and exploit emerging technologies. The remaining vulnerabilities were distributed across various sectors, including enterprise software, security tools, networking, and cloud solutions, each presenting unique challenges to security teams already stretched thin.

Vulnerabilities in Focus: Active Exploits

The following table represents vulnerabilities that were actively exploited throughout May 2026. It focuses only on the 22 that faced actual attacks, excluding the honeypot-related CVEs available in Recorded Future’s CVE Monthly Report. Each entry includes brief evidence of public proof of concept (PoC) exploits where applicable. It is paramount for security teams to verify the effectiveness and accuracy of these PoCs prior to implementation, as relying solely on publicly available information can sometimes lead to misguided efforts.

Table Overview: The following vulnerabilities were exploited during May 2026 based on Recorded Future’s intelligence data.

Key Trends Observed

• In May, noteworthy attempts were made by threat actors to exploit a vulnerability in the Ghost CMS through large-scale ClickFix and FakeCaptcha poisoning campaigns. These campaigns leveraged compromised Ghost CMS platforms to inject malicious JavaScript, redirecting victims through deceiving tactics to stage payloads from attacker-controlled points.
• Out of the critical vulnerabilities, 12 enabled remote code execution (RCE), impacting products from major vendors such as Microsoft, Adobe, and Palo Alto Networks. Given the high-profile nature of these brands, the repercussions of a successful exploit could ripple across various sectors.
• Proof-of-concept exploits were identified for 32 of the reported vulnerabilities this month, illustrating the pressing need for prompt patching and remediation efforts. This is more significant than it looks; PoC availability often translates into a higher risk for organizations.
• Cross-site Scripting (CWE-79), Embedded Malicious Code (CWE-506), and SQL Injection (CWE-89) were the most frequently exploited types, with three entries each appearing this month. This serves as a reminder that while new vulnerabilities emerge, many older ones remain ripe for exploitation.
• Alarmingly, five vulnerabilities first disclosed between 2008 and 2010 remain exploitable, underscoring a troubling trend where attackers can exploit long-known issues due to inadequate patching. If you’re working in this space, this should be a wake-up call.

Specific Exploitation Case: Ghost CMS

An insightful case highlighted by XLab on May 21, 2026, illustrated how threat actors exploited CVE-2026-26980 to execute large-scale ClickFix poisoning campaigns targeting vulnerable instances of Ghost CMS. This SQL injection vulnerability allows unauthorized entrants to obtain vital Ghost Admin API Keys and alter website content. The impact here is multifaceted; not only does it compromise individual sites, but it could also erode user trust across the entire platform.

These operations resulted in the injection of malicious scripts into over 700 compromised Ghost CMS websites operating across various industries, including blockchain and fintech. The attacks employed social engineering techniques aimed at tricking users into executing harmful commands. The sophistication of these methods indicates a well-organized effort by cybercriminals, which organizations often fail to anticipate.

Insikt Group® presented a sample known as UtilifySetup.exe, discovered through its Malware Intelligence program. This sample aligns with detection rules and was analyzed in a sandbox environment, where it exhibited a range of malicious behaviors including DLL injection, file enumeration, and registry manipulation. The ramifications of this attack extend beyond immediate financial losses, potentially affecting brand reputation and customer loyalty.

• After execution, notable actions included:
• Creating registry entries to execute itself upon user login
• Enumerating running processes and gathering system information
• Dropping temporary files for further operations

Further technical insights regarding these campaigns and associated malware samples are available exclusively to Recorded Future customers. It’s clear that for organizations, having comprehensive threat intel is essential to stay ahead of evolving security challenges.

Figure 1: Risk rules history from Recorded Future’s Vulnerability Intelligence relating to CVE-2026-26980.

Implications and Future Outlook

The data presented here reflects more than just numbers; it indicates a significant trend in the cyber threat environment. As more vulnerabilities come to light, organizations must reconsider their security strategies. Simply put, traditional patching methods may not suffice anymore. The rise in sophisticated attacks, especially on well-known platforms like Ghost CMS, points to an urgent need for adaptive defenses, incorporating threat intelligence and continuous monitoring.

Investments in security infrastructure have been made; however, the persistent exploitation of known vulnerabilities shows that many organizations still struggle with execution. The question remains: how far will companies be willing to go to ensure their systems are not the next target? There's great risk in complacency, as attackers are clearly capitalizing on outdated vulnerabilities. Prepare, update, and act. That’s more critical than ever.