U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog


U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
May 21, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Windows Shell and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the flaws added to the catalog:

  • CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability
  • CVE-2009-1537 Microsoft DirectX NULL Byte Overwrite Vulnerability
  • CVE-2009-3459 Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
  • CVE-2010-0249 Microsoft Internet Explorer Use-After-Free Vulnerability
  • CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Vulnerability
  • CVE-2026-41091 Microsoft Defender Elevation of Privilege Vulnerability
  • CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability

CVE-2008-4250 (CVSS v3.1 score of 9.8) is a critical remote code execution flaw in the Microsoft Windows Server service, associated with the MS08-067 vulnerability. It affects older versions of Windows, including Windows XP, Server 2003, Vista, and Server 2008. Attackers can exploit it remotely by sending specially crafted RPC requests that trigger a buffer overflow during path canonicalization, allowing arbitrary code execution without authentication.

The second flaw added to the catalog (tracked as CVE-2009-1537, CVSS v2 score of 9.3) is a critical vulnerability in Microsoft DirectX caused by a NULL byte overwrite issue. It affects multiple Windows versions and can allow remote code execution if a user opens a specially crafted QuickTime media file. Successful exploitation could let attackers run arbitrary code with the privileges of the logged-in user.

The third flaw added to the catalog (tracked as CVE-2009-3459, CVSS v2 score of 9.3) is a critical heap-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader. Attackers can exploit the flaw using a specially crafted PDF file, potentially leading to arbitrary code execution on vulnerable systems when the document is opened.

The fourth flaw added to the catalog (tracked as CVE-2010-0249, CVSS v2 score of 9.3) is a critical use-after-free vulnerability in Microsoft Internet Explorer. The flaw can be triggered through malicious web content, allowing remote attackers to execute arbitrary code in the context of the current user after visiting a crafted website.

The fifth flaw added to the catalog (tracked as CVE-2010-0806, CVSS v2 score of 9.3) is another critical use-after-free vulnerability in Microsoft Internet Explorer. It affects older IE versions and allows attackers to gain remote code execution by convincing users to visit a malicious webpage containing specially crafted HTML and scripting content. The APT group GREF exploited the flaw as a zero-day in targeted attacks.

The sixth flaw added to the catalog (tracked as CVE-2026-41091, CVSS v3.1 score of 7.8) is a Microsoft Defender elevation of privilege vulnerability. Successful exploitation could allow a local attacker to gain higher privileges on the affected system, potentially enabling further compromise or lateral movement within a network.

The seventh flaw added to the catalog (tracked as CVE-2026-45498, CVSS v3.1 score of 6.5) is a denial-of-service vulnerability in Microsoft Defender. An attacker could exploit the flaw to cause security services to become unavailable or unresponsive, impacting the protection capabilities of affected Windows systems.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by June 3, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


datafoundationgettyimages-1472653690

Eugene Mymrin/ Moment via Getty Images

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • Trusted quality data is the backbone of agentic AI.
  • Identifying high-impact workflows to assign to AI agents is key to scaling adoption.
  • Scaling agentic AI starts with rethinking how work gets done. 

Gartner forecasts that worldwide AI spending will total $2.5 trillion in 2026, a 44% year-over-year increase. Spending on AI platforms for data science and machine learning will reach $31 billion, and spending on AI data will reach $3 billion.

The global agentic AI market will reach $8.5 billion by the end of 2026 and nearly $40 billion by 2030, per Deloitte Digital. Organizations are rapidly accelerating their adoption of AI agents, with the current average utilization standing at 12 agents per organization, according to MuleSoft 2026 research. This rate is projected to increase by 67% over the next two years, reaching an average of 20 AI agents. 

Also: How to build better AI agents for your business – without creating trust issues

According to IDC, by 2026, 40% of all Global 2000 job roles will involve working with AI agents, redefining long-held traditional entry, mid, and senior level positions. But the journey will not be smooth. By 2027, companies that do not prioritize high-quality, AI-ready data will struggle to scale generative AI and agentic solutions, resulting in a 15% loss in productivity. While 2025 was the year of pilot experiments and small production deployments of agentic AI, 2026 is shaping up to be the year of scaling agentic AI. And to scale agentic AI, according to IDC’s forecast, companies will need trustworthy, accessible, and quality data. 

Scaling agentic AI adoption in business requires a strong data foundation, according to McKinsey research. Businesses can create high-impact workflows by using agents, but to do so, they must modernize their data architecture, improve data quality, and advance their operating models. 

McKinsey found that nearly two-thirds of enterprises worldwide have experimented with agents, but fewer than 10% have scaled them to deliver measurable value. The biggest obstacle to scaling agent adoption is poor data — eight in ten companies cite data limitations as a roadblock to scaling agentic AI. 

Also: AI agents are fast, loose, and out of control, MIT study finds

McKinsey identified the top data limitations as primary constraints that companies face when scaling AI, including: operating model and talent constraints, data limitations, ineffective change management, and tech platform limitations. 

Data is the backbone of agentic AI

Research shows that agentic AI needs a steady flow of high-quality, trusted data to accurately automate complex business workflows. Successful agentic AI also depends on a data architecture that can support autonomy — executing tasks without human intervention. 

Two agentic usage models are emerging: single-agent workflows (one agent using multiple tools) and multi-agent workflows (specialized agents collaborate). In each case, agents will rely on access to high-quality data. Data silos and fragmented data would lead to errors and poor agentic decision-making. 

Four steps for preparing your data 

McKinsey identified four coordinated steps that connect strategy, technology, and people in order to build strong foundational data capabilities. 

Also: Prolonged AI use can be hazardous to your health and work: 4 ways to stay safe

  1. Identify high-impact workflows to ‘agentify’. Focus on highly deterministic, repetitive tasks that deliver value as strong candidates for AI agents. 

  2. Modernize each layer of the data architecture for agents. The focus on modernization should support interoperability, easy access, and governance across systems. The vast majority of business applications do not share data across platforms. According to MuleSoft research, organizations are rapidly adopting autonomous systems. The average enterprise now manages 957 applications — rising to 1,057 for those furthest along in their agentic AI journey. Only 27% of these applications are currently connected, creating a significant challenge for IT leaders aiming to meet their near-term AI implementation goals. 

  3. Ensure that data quality is in place. Businesses must ensure that both structured and unstructured data, as well as agent-generated data, meet consistent standards for accuracy, lineage, and governance. Access to trusted data is a key obstacle. IT teams now spend an average of 36% of their time designing, building, and testing new custom integrations between systems and data. Custom work will not help scale AI adoption. The most significant obstacle to successful AI or AI agent deployment is data quality, cited as the top concern by 25% of organizations. Furthermore, almost all organizations (96%) struggle to use data from across the business for AI initiatives.  

  4. Build an operating and governance model for agentic AI. This is about rethinking how work gets done. Human roles will shift from execution to supervision and orchestration of agent-led workflows. In a hybrid work environment, governance will dictate how agents can operate autonomously in a trustworthy, transparent, and scaled manner. 

The work assigned to AI agents 

McKinsey highlighted the importance of identifying a few critical workflows that would be candidates for AI agents to own. To begin, an end-to-end workflow mapping would help identify opportunities for agentic use. McKinsey found that AI adoption is led by customer service, marketing, knowledge management, and IT. It is important to identify clear metrics that validate impact. Teams should identify the data that can be reused across tasks and workflows.

Also: These companies are actually upskilling their workers for AI – here’s how they do it

McKinsey concludes that having access to high-quality data is a strategic differentiator in the agentic AI era. Because agents will generate enormous amounts of data, data quality, lineage, and standardization will be even more important in the agentic enterprise. And as agentic systems scale, governance becomes the primary level for control. The data foundation will be the competitive advantage in the agentic era. 





Source link