Overall Risk Posture: High

The week ending May 17 was defined by active exploitation against Cisco Catalyst SD-WAN infrastructure and on-premises Microsoft Exchange Server.

Both issues matter because they affect systems with enterprise leverage. SD-WAN controllers influence network behavior. Exchange sits close to email, sessions, attachments, and business workflows. In both cases, the priority is not only patching. It is also validating whether attackers accessed the environment before remediation.

• Cisco SD-WAN became the week’s highest-control-risk issue
  On May 14, CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities catalog. The flaw affects Cisco Catalyst SD-WAN Controller and Manager and is rated CVSS 10.0.
  
  Cisco described the issue as an authentication bypass vulnerability that could allow an unauthenticated remote attacker to obtain administrative privileges on an affected system. Cisco Talos attributed active exploitation with high confidence to UAT-8616 and reported post-compromise activity including SSH key additions, NETCONF configuration changes, and privilege escalation attempts.
• Exchange Server brought email infrastructure back into zero-day focus
  On May 15, CISA added CVE-2026-42897 to the KEV catalog. The vulnerability affects Microsoft Exchange Server and is tied to Outlook Web Access in on-premises environments.
  
  Microsoft described the impact as spoofing over a network and provided mitigations while administrators wait for a permanent fix. For exposed OWA deployments, this should be treated as an active-exploitation issue, not a routine web-application bug.
• Patch Tuesday added background pressure
  Microsoft’s May 2026 Patch Tuesday added a large set of fixes across Windows, Office, Azure, and other enterprise products. The practical priority is to move first on internet-facing systems, identity-adjacent services, remote code execution, and privilege escalation paths.

• Control planes remain prime targets
  SD-WAN infrastructure, firewall managers, cloud consoles, identity systems, and device-management platforms all share one risk: compromise can affect more than one host.
• Administrative access is the real impact
  CVSS scores matter, but defenders should also ask what the vulnerable product controls after exploitation. In the Cisco case, the affected system helps manage the network fabric.
• Exchange remains strategically valuable
  On-premises Exchange exposure remains important because attackers value access to communications, sessions, attachments, and business workflows.
• KEV should trigger investigation, not only patching
  When CISA adds a vulnerability because of active exploitation, remediation should include log review, account review, and configuration validation.

• Patch affected Cisco Catalyst SD-WAN Controller and Manager systems for CVE-2026-20182.
• Review Cisco SD-WAN authentication logs, NETCONF activity, SSH key changes, controller configuration changes, unexpected administrative accounts, and unusual access to management interfaces.
• Check for web shells, suspicious JSP files, tunneling tools, miners, unexpected outbound connections, and other post-compromise artifacts from SD-WAN management systems.
• Apply Microsoft’s temporary mitigations for CVE-2026-42897 in on-premises Exchange Server environments.
• Review Outlook Web Access exposure, mailbox audit logs, suspicious inbox rules, unusual login activity, and signs of session abuse or spoofing attempts.
• Prioritize May Patch Tuesday fixes based on attacker utility: remote code execution, privilege escalation, exposed services, and identity-adjacent systems.

The week ending May 17 produced a clear infrastructure story. Cisco SD-WAN represented the network control plane. Microsoft Exchange represented enterprise communications. Patch Tuesday added the operational backlog.

These are different technologies, but they sit in similar positions of trust. That is why defenders should treat remediation as both a patching task and an investigation task.

This week’s threat picture was shaped by active exploitation against high-leverage infrastructure. Cisco Catalyst SD-WAN showed how attackers continue to target network control systems. Microsoft Exchange showed that on-premises email remains one of the most valuable enterprise attack surfaces.

For defenders, the priority is clear: patch Cisco SD-WAN, apply Exchange mitigations, review exposed management and OWA surfaces, and investigate for signs of access before remediation. The work does not end when the update is installed.