Friday, May 8, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Friday's disclosures center on cloud and collaboration infrastructure, with critical flaws in Azure DevOps, Microsoft Teams, Apache Cassandra, and Kubernetes affecting widely deployed enterprise environments. Critical CVE volume rose 82% to 20 from 11 the prior day, while high-priority issues held steady at 100. Notable entries include CVE-2026-33587 (CVSS 10) impacting Docker container isolation, CVE-2026-42826 (CVSS 10) in Azure DevOps, and CVE-2026-33109 (CVSS 9.9) in Apache Cassandra. Remote code execution, container escape, and secret exposure dominate the attack patterns, with cloud-native and DevOps toolchains carrying the heaviest exposure. No vendor patches are currently available across this set, requiring teams to rely on configuration hardening, network segmentation, and compensating controls until fixes ship.

  • Cloud and DevOps platforms lead exposure: Azure DevOps, Azure Cloud Shell, Kubernetes, and Apache Cassandra all carry CVSS 9.6+ flaws
  • Critical CVEs rose 82% day-over-day to 20, driven by container and cloud orchestration issues
  • High-priority CVEs held flat at 100, sustaining elevated remediation workload
  • Attack patterns concentrate on container escape (Docker CVE-2026-33587), secret exposure (Kubernetes CVE-2026-42880), and RCE in collaboration tools (Microsoft Teams CVE-2026-33823)
  • Patch availability sits at 0% across the disclosed set, leaving mitigation as the only near-term option
  • Five CVEs show active exploitation, including Palo Alto PAN, Ivanti EPMM, ConnectWise ScreenConnect, Windows, and Linux Kernel

Immediate action: Prioritize inventory and exposure assessment for Azure DevOps, Microsoft Teams, Apache Cassandra, Kubernetes, and Docker environments, alongside the actively exploited Palo Alto, Ivanti EPMM, and ConnectWise ScreenConnect deployments. With no patches yet available for the new critical CVEs, apply network segmentation, restrict administrative access, and enable enhanced logging on affected systems while monitoring vendor advisories for fix releases.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation