🛡️ CISO Intel — Friday, 22-05-2026

By Marcus Reed | 21-05-2026 08:00 IST → 22-05-2026 08:00 IST | Sources cross-referenced

Executive Summary

This week, the cybersecurity landscape has been dominated by a sobering reality: our foundational defenses are under direct assault, and AI is accelerating the pace of exploitation. Microsoft Defender, our frontline endpoint protection, has been hit with two actively exploited zero-days, one granting SYSTEM privileges, the other disabling the service entirely. This, coupled with a critical Linux kernel privilege escalation, means attackers are aiming for the deepest levels of our infrastructure. The Verizon DBIR confirms our fears, stating that vulnerability exploitation has surpassed stolen credentials as the leading initial access vector, with AI shrinking the window between disclosure and weaponization to mere hours. Meanwhile, sophisticated supply chain attacks, exemplified by the TanStack compromise, demonstrate that even robust provenance checks are insufficient when the build pipeline itself is hijacked.

🔴 Critical Threats — Act Now

Microsoft Defender Zero-Days: SYSTEM Privilege Escalation and DoS

What happened: Microsoft has rolled out emergency security updates for two actively exploited zero-day vulnerabilities affecting its Defender suite: CVE-2026-41091 (CVSS 7.8) and CVE-2026-45498 (CVSS 4.0). CVE-2026-41091 is a privilege escalation flaw in the Microsoft Malware Protection Engine (MPE), allowing an attacker to achieve SYSTEM privileges. CVE-2026-45498 is a denial-of-service (DoS) vulnerability in the Microsoft Defender Antimalware Platform, which can be exploited to disable Defender. Both have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, with a mandatory patch deadline for federal agencies of June 3, 2026.

Source verification: This incident is widely confirmed across multiple reputable security news outlets (BleepingComputer, Forbes, Help Net Security, The Hacker News, CSO Online) and is backed by Microsoft’s own advisories and CISA’s KEV catalog. There are no conflicting reports. The vulnerabilities are confirmed to be actively exploited in the wild.

Technical breakdown:

• CVE-2026-41091 (Privilege Escalation): This flaw resides in the mpengine.dll component of the Malware Protection Engine and is described as an “improper link resolution before file access” or “link following” vulnerability. Essentially, the MPE mishandles symbolic links or shortcuts, which an attacker can abuse to trick the engine into performing actions with SYSTEM privileges on a file the attacker controls. This allows a local attacker to escalate their privileges to the highest level on the system. MITRE ATT&CK mapping: T1068 (Exploitation for Privilege Escalation).
• CVE-2026-45498 (Denial of Service): This vulnerability affects the Microsoft Defender Antimalware Platform (specifically MsMpEng.exe and associated kernel-mode drivers). Successful exploitation allows threat actors to trigger a denial-of-service state, effectively disabling the anti-malware protection on the affected device. This is a critical precursor to other attacks, as it removes the primary defense mechanism. MITRE ATT&CK mapping: T1499 (Endpoint Denial of Service). Security experts suggest these two flaws might be related to the “RedSun” and “UnDefend” exploits disclosed last month by a researcher known as Nightmare Eclipse, though Microsoft has not officially confirmed this link.

Blast radius: These vulnerabilities affect systems running Microsoft Defender, Microsoft System Center Endpoint Protection, System Center 2012 R2 Endpoint Protection, System Center 2012 Endpoint Protection, and Microsoft Security Essentials. Given Defender’s pervasive deployment across Windows environments, the blast radius is significant, impacting virtually any Windows endpoint or server where Defender is active. The privilege escalation grants full control, and the DoS capability allows attackers to blind the system to subsequent malicious activity.

Marcus’s verdict:

This is a gut punch, plain and simple. Attackers are going after our primary endpoint defense, not just to bypass it, but to turn it off or hijack its privileges. CVE-2026-41091 is a classic local privilege escalation to SYSTEM, the holy grail for an attacker who’s already landed on a box. CVE-2026-45498 is almost worse in some ways; it’s a direct shot at disabling your sentinel. If your EDR/EPP is compromised, you’re flying blind. The fact that these are actively exploited zero-days means the bad guys are already using them. This isn’t theoretical; it’s happening now. The auto-update mechanism is usually reliable, but you must verify. Trust, but verify, especially when your core defense is the target.

What to do:

1. Immediate Verification: Do not assume auto-updates have applied. Manually verify that all Windows endpoints and servers running Microsoft Defender have updated to Malware Protection Engine version 1.1.26040.8 or later and Antimalware Platform version 4.18.26040.7 or later.
2. Prioritize Patching: For any systems not automatically updated, initiate manual updates immediately.
3. Monitor EDR Alerts: Scrutinize any alerts related to Defender service stoppages or unusual process activity, particularly if they precede other suspicious events.
4. Layered Defense: Re-emphasize the importance of a layered defense strategy. While Defender is critical, it’s not the only control. Ensure your network segmentation, least privilege, and application whitelisting are robust.

Linux Kernel ptrace Privilege Escalation (CVE-2026-46333)

What happened: The Qualys Threat Research Unit (TRU) has identified and disclosed CVE-2026-46333, a logic flaw in the Linux kernel’s __ptrace_may_access() function. This vulnerability allows an unprivileged local user to achieve root privilege escalation and disclose sensitive files, such as SSH host private keys and password hashes from /etc/shadow, on various default Linux distributions. The flaw has been present in the mainline Linux kernel since version 4.10-rc1 (November 2016). Exploits are publicly circulating.

Source verification: Qualys TRU’s official blog post provides the primary disclosure, corroborated by NVD, Ubuntu’s security advisories, and various security news sites (The Hacker News, SecurityWeek). The existence of public exploits is confirmed. There is a CVSS score discrepancy: CISA-ADP assigns a CVSS 3.1 score of 5.5 (Medium severity) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while SUSE assigns a CVSS 3.1 score of 7.8 (High severity) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. SUSE’s assessment includes Integrity and Availability impacts, which CISA-ADP’s does not, leading to the higher score. Given the ability to execute arbitrary commands as root, SUSE’s higher score seems more reflective of the true impact.

Technical breakdown: The vulnerability is a race condition within the kernel’s ptrace access-check path, specifically in the do_exit code path. During a narrow window between a privileged task’s memory descriptor being detached and its file descriptor table being closed, the ptrace access check bypasses its dumpable safeguard. An unprivileged process can leverage the pidfd_getfd() syscall (introduced in Linux 5.6, January 2020) to copy open file descriptors from the exiting privileged process. Qualys demonstrated this by targeting ssh-keysign (a setuid binary that briefly holds SSH host private keys open) to exfiltrate SSH private keys, and chage (which reads /etc/shadow) to steal password hashes. Exploits were also developed for pkexec and accounts-daemon. MITRE ATT&CK mapping: T1068 (Exploitation for Privilege Escalation), T1552 (Unsecured Credentials).

Blast radius: This is a local-only vulnerability, meaning an attacker needs an initial foothold on the system. However, its impact is severe, as it turns any unprivileged shell into a direct path to root or sensitive credential material. This affects default installations of major distributions like Debian, Fedora, and Ubuntu. Any compromised low-privilege account, CI runner, or multi-tenant host becomes a direct vector to full system compromise.

Marcus’s verdict:

Another week, another Linux kernel LPE. This ptrace flaw has been lurking for nine years, which is a testament to how subtle and complex these kernel bugs can be. The fact that Qualys found it and quickly saw public exploits means this window is closing fast. Don’t let the “local-only” tag lull you into a false sense of security. Most sophisticated attacks start with a low-privilege foothold. This vulnerability turns that foothold into a full-blown root compromise, giving attackers keys to the kingdom like SSH private keys and password hashes. If you’re running Linux servers, especially multi-tenant or CI/CD environments, this is a five-alarm fire.

What to do:

1. Immediate Kernel Update: Apply vendor kernel updates without delay. This is the most effective and complete fix.
2. Mitigation (if immediate patch impossible): As a temporary workaround, consider raising kernel.yama.ptrace_scope to 2. Be aware this may impact debugging tools like gdb for unprivileged users.
3. Post-Compromise Review: If you’ve had untrusted local users on vulnerable hosts, assume SSH host keys and locally cached credentials are compromised. Rotate host keys and review any administrative material that resided in the memory of set-uid processes.

Langflow AI Workflow Vulnerability (CVE-2025-34291)

What happened: CISA has added CVE-2025-34291 to its KEV catalog, confirming active exploitation of this vulnerability in Langflow, an open-source framework for building and deploying AI applications. Attackers are targeting exposed control planes.

Source verification: CISA’s KEV catalog entry confirms active exploitation. However, detailed technical advisories from Langflow or independent security researchers regarding the specific mechanism of CVE-2025-34291 are not immediately available within the search window. This indicates that while CISA has confirmed exploitation, the public technical details are still emerging.

Technical breakdown: Langflow is an AI workflow layer, designed to orchestrate AI agents and components. The vulnerability targets “exposed control planes.” While specific technical details are sparse, this likely implies that misconfigured or publicly accessible Langflow instances are being targeted. Attackers could potentially gain unauthorized access to these control planes to:

• Manipulate AI workflows, injecting malicious prompts or data.
• Exfiltrate sensitive data processed by AI agents.
• Gain control over underlying infrastructure used by Langflow.
• Disrupt AI service availability. MITRE ATT&CK mapping: T1588.006 (Compromise Software Supply Chain - if malicious components are injected), T1552 (Unsecured Credentials - if control plane access leads to credential theft), T1566 (Phishing - if AI is used to generate attacks).

Blast radius: Any organization deploying Langflow, especially with publicly accessible or inadequately secured control planes, is at risk. Given Langflow’s role in orchestrating AI agents, a compromise could have far-reaching implications for the integrity and confidentiality of AI-driven processes and data.

Marcus’s verdict:

This is exactly what I’ve been warning about: AI application platforms becoming prime targets. Langflow is a critical piece of the AI workflow, and if its control plane is exposed, it’s not just a vulnerability in a single application; it’s a vulnerability in your entire AI operational pipeline. This isn’t just about data breaches; it’s about the integrity of your AI models and the decisions they make. The lack of immediate public technical details is concerning, but CISA’s KEV listing is a clear signal: the bad guys know how to hit this, and they are.

What to do:

1. Identify Langflow Instances: Immediately identify all deployed Langflow instances within your environment.
2. Review Network Exposure: Ensure that Langflow control planes are not exposed to the public internet unless absolutely necessary, and if so, are protected by strong authentication, IP whitelisting, and other network access controls.
3. Apply Updates: Monitor Langflow’s official channels for security advisories and apply any available patches or configuration changes for CVE-2025-34291 without delay.
4. Audit AI Workflows: Conduct an urgent audit of any AI workflows orchestrated by Langflow for signs of tampering or unauthorized activity.

Trend Micro Apex One (on-premise) Exploitation (CVE-2026-34926)

What happened: CVE-2026-34926, a vulnerability in Trend Micro Apex One (on-premise), has been added to CISA’s KEV catalog, indicating active exploitation in the wild. Attackers are specifically targeting management consoles.

Source verification: CISA’s KEV catalog entry confirms active exploitation. Trend Micro has likely issued an advisory, but specific details were not immediately found within the search window.

Technical breakdown: Trend Micro Apex One is an endpoint security management solution. A vulnerability in its on-premise version’s management console suggests that attackers are likely exploiting a flaw (e.g., authentication bypass, remote code execution, or command injection) to gain unauthorized access to the console. Once an attacker controls the management console, they could:

• Disable endpoint security agents across the organization.
• Deploy malicious software to managed endpoints.
• Exfiltrate sensitive data from the console itself (e.g., configuration, logs, user information).
• Manipulate security policies, creating blind spots. MITRE ATT&CK mapping: T1213 (Exploitation for Client Execution - if used to push malware), T1562.001 (Impair Defenses: Disable or Modify Tools), T1078 (Valid Accounts - if an authentication bypass is used).

Blast radius: Organizations using Trend Micro Apex One on-premise are directly affected. Compromise of the management console represents a significant breach of an organization’s security posture, potentially impacting all endpoints managed by that console.

Marcus’s verdict:

Endpoint security management consoles are high-value targets. If an attacker can control your anti-malware system, they effectively own your endpoints. This isn’t just about a single machine; it’s about the central nervous system of your endpoint defense. The fact that CISA has it in KEV means this is a real and present danger. If you’re running Apex One on-prem, assume your management console is in the crosshairs.

What to do:

1. Identify Apex One Instances: Pinpoint all Trend Micro Apex One (on-premise) management consoles.
2. Review Console Exposure: Ensure management consoles are not publicly