Overall Risk Posture: Elevated

The week ending May 10 was defined by active exploitation across edge security appliances, mobile device management infrastructure, and AI gateway software. CISA’s Known Exploited Vulnerabilities catalog reflected a clear pattern: attackers are continuing to prioritize systems that sit close to access control, administration, credentials, and downstream services.

The most important additions were not ordinary application bugs. They affected Palo Alto Networks PAN-OS firewalls, Ivanti Endpoint Manager Mobile, and BerriAI LiteLLM. Each product plays a different role, but the operational risk is similar. These systems often sit between users, devices, APIs, credentials, and other systems. When they are exposed or loosely controlled, compromise can move beyond one vulnerable host.

The clearest message for defenders is simple: this week was not only about patching three CVEs. It was about validating exposed control points, reviewing authentication paths, checking privileged access, and confirming whether attackers touched the systems before remediation happened.

• Palo Alto Networks PAN-OS became the highest-priority edge issue
  On May 6, CISA added CVE-2026-0300, a Palo Alto Networks PAN-OS vulnerability affecting the User-ID Authentication Portal, also known as the Captive Portal. Palo Alto Networks described the issue as a buffer overflow vulnerability that could allow an unauthenticated attacker to execute code with root privileges on affected PA-Series and VM-Series firewalls.
  
  The exposure condition matters. The risk is highest where the User-ID Authentication Portal is reachable from untrusted networks or the public internet. That makes this more than a standard firewall patch item. A vulnerable authentication portal on an edge device can sit directly in front of users, network flows, and administrative trust boundaries.
  
  For defenders, the priority is to confirm whether the portal is enabled, whether it is reachable externally, and whether access is restricted to trusted networks. Until fixed versions are applied, organizations should follow vendor mitigation guidance, restrict portal exposure, and review logs for suspicious activity around exposed interfaces.
• Ivanti EPMM kept management infrastructure in the attacker’s focus
  On May 7, CISA added CVE-2026-6973, an Ivanti Endpoint Manager Mobile improper input validation vulnerability, to the KEV catalog. The vulnerability affects on-premises Ivanti EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1.
  
  Successful exploitation requires administrative authentication, but that should not make the issue feel minor. In real incidents, attackers often arrive with stolen credentials, reused passwords, compromised sessions, or previously obtained administrator access. A vulnerability that turns authenticated administrative access into remote code execution can still become a serious escalation point.
  
  EPMM matters because it is management infrastructure. It can affect mobile device policies, administrative workflows, device enrollment, and downstream trust. For organizations using on-premises Ivanti EPMM, patching should be paired with administrator account review, configuration review, and inspection of recent management activity.
• LiteLLM moved AI infrastructure into the KEV conversation
  On May 8, CISA added CVE-2026-42208, a BerriAI LiteLLM SQL injection vulnerability, to the KEV catalog. LiteLLM is commonly used as an AI gateway or proxy for routing requests to model providers through OpenAI-compatible APIs.
  
  LiteLLM’s advisory states that the vulnerability affects the proxy’s API key verification path and impacts versions from v1.81.16 through v1.83.6. The vendor recommends upgrading to v1.83.10-stable, or at minimum v1.83.7 or later.
  
  The risk is larger than the phrase “SQL injection” may suggest. In many environments, an AI gateway is not just a developer convenience. It can centralize model provider credentials, virtual API keys, routing logic, usage controls, and access to internal AI workflows. If a vulnerable proxy is reachable from an untrusted network, the concern becomes credential exposure, configuration exposure, and unauthorized access to AI infrastructure.

• Edge authentication services remain high-value targets
  The PAN-OS entry reinforces a familiar pattern. Attackers continue to look for exposed services that sit at the edge of the network and carry authentication or access-control significance. Firewalls, portals, VPNs, and remote access systems are attractive because compromise can create leverage before attackers touch internal systems.
• Authenticated vulnerabilities can still become incident-level risks
  The Ivanti EPMM issue is a reminder that “requires authentication” does not mean “low priority.” If the required account is privileged, and the vulnerable system manages other devices or policies, the flaw can still be valuable to an attacker who already has a foothold. Defenders should treat management-platform vulnerabilities as part of the broader identity and privilege risk picture.
• AI gateways are becoming production infrastructure
  LiteLLM’s KEV addition is one of the clearest signals this week. AI gateways are no longer just experimental developer tools. In many organizations, they now manage access to model providers, API keys, usage rules, routing decisions, and internal application workflows. That means they need the same exposure control, patching discipline, logging, and secret management as other production gateways.
• Credential exposure is the common thread
  The affected technologies are different, but each one sits close to credentials or privileged workflows. PAN-OS sits at the edge. Ivanti EPMM sits in device management. LiteLLM can sit in front of model-provider keys and internal AI access. The week’s pattern is not only exploitation. It is exploitation against systems that can expose or amplify trust.
• KEV deadlines are getting operationally tight
  CISA’s KEV dates for these entries were short. That reflects the reality of active exploitation. When the affected product controls access, manages devices, or stores sensitive keys, defenders do not have the luxury of treating remediation as a normal monthly patch task.
• Edge exploitation was already moving before the KEV deadline
  The PAN-OS issue should not be viewed only as a May 6 KEV entry. Research summarized by SANS noted exploitation activity before the catalog addition, including attempts against the User-ID Authentication Portal and follow-on activity involving tunneling and proxy tooling. That makes exposure review especially important. If the portal was reachable from untrusted networks before mitigation, defenders should treat the system as something to investigate, not only something to patch.

• Confirm whether any Palo Alto Networks PAN-OS User-ID Authentication Portals are enabled and reachable from untrusted networks. For CVE-2026-0300, restrict portal exposure, follow Palo Alto Networks mitigation guidance, and review access patterns for suspicious activity.
• Update affected Ivanti EPMM on-premises deployments for CVE-2026-6973. Prioritize environments running versions before 12.6.1.1, 12.7.0.1, or 12.8.0.1.
• Review Ivanti EPMM administrator accounts, recent administrative actions, device-management changes, and access logs. Because exploitation requires administrative authentication, account review is part of the response, not a separate cleanup task.
• Upgrade LiteLLM Proxy for CVE-2026-42208. Move to v1.83.10-stable where possible, or at minimum v1.83.7 or later.
• For exposed LiteLLM deployments, review proxy logs, database query history, API key usage, and access attempts. Rotate virtual API keys, provider credentials, and related secrets where exposure is suspected.
• Use KEV status as a post-exploitation trigger, not only a patch trigger. For edge devices, management platforms, and AI gateways, remediation should include log review, account review, token review, and validation that the system was not accessed before the fix.

The week ending May 10 produced a clear infrastructure story. Palo Alto Networks PAN-OS represented edge security and authentication exposure. Ivanti EPMM represented device-management infrastructure. LiteLLM represented the emerging AI gateway layer, where model access, routing logic, and API credentials often converge.

Those categories are different, but the operational lesson is the same. Attackers are looking for systems that give them leverage. They want software that sits between users and services, between administrators and devices, or between applications and sensitive credentials.

That is why the week remains elevated. The risk is not only the CVE list. The risk is what those systems control after compromise.

This week’s threat picture was defined by edge and gateway exposure. CISA’s KEV additions showed active exploitation affecting firewalls, mobile device management, and AI proxy infrastructure. The most urgent issue was not only patch availability. It was exposure, privilege, and attacker utility.

For defenders, the priority is to identify systems that sit close to access control, device management, credentials, and shared infrastructure. Validate PAN-OS User-ID Authentication Portal exposure. Patch Ivanti EPMM. Upgrade LiteLLM. Then review logs, administrator actions, tokens, and keys to determine whether exploitation occurred before remediation.

The week’s lesson is straightforward: when attackers target the systems that sit in front of everything else, remediation cannot stop at “update installed.” It has to include validation that control has not already been lost.