2026-05-19: Microsoft Exchange zero-day CVE-2026-42897 is under active attack with no patch available

Show Notes - 2026-05-19 Stories Covered: - Today: - Microsoft Exchange Zero-Day Under Attack (CVE-2026-42897) (https://www.darkreading.com/vulnerabilities-threats/microsoft-exchange-zero-day-no-patch) - Cisco SD-WAN Controller Under Exploitation (CVE-2026-20182) (https://thehackernews.com/2026/05/weekly-recap-exchange-0-day-npm-worm.html) - Ivanti Xtraction RCE (CVE-2026-8043) (https://thehackernews.com/2026/05/ivanti-fortinet-sap-vmware-n8n-patch.html) - TeamPCP Supply Chain Campaign Reaches Peak Intensity (https://thehackernews.com/2026/05/weekly-recap-exchange-0-day-npm-worm.html) - CISA Contractor Leaked AWS GovCloud Keys on GitHub (https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/) - Threat Actors Disabling Antivirus and EDR (https://www.huntress.com/blog/how-attackers-disable-av-edr) - Developer Workstations Are Part of the Software Supply Chain (https://thehackernews.com/2026/05/developer-workstations-are-now-part-of.html) - Storm-2949 Turned Compromised Identity into Cloud-Wide Breach (https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/) - BitLocker Zero-Day Exploit (YellowKey) (https://www.schneier.com/blog/archives/2026/05/zero-day-exploit-against-windows-bitlocker.html) - macOS Stealer SHub Reaper Spoofs Apple, Google, and Microsoft (https://www.sentinelone.com/blog/shub-reaper-macos-stealer-spoofs-apple-google-and-microsoft-in-a-single-attack-chain/) - Microsoft Security Focus on Small Business (https://www.microsoft.com/en-us/security/blog/2026/05/18/how-to-better-protect-your-growing-business-in-an-ai-powered-world/) - Fortinet Critical RCE Vulnerabilities (https://thehackernews.com/2026/05/ivanti-fortinet-sap-vmware-n8n-patch.html) - SAP Critical SQL Injection and Authentication Bypass (https://thehackernews.com/2026/05/ivanti-fortinet-sap-vmware-n8n-patch.html) - VMware Fusion Privilege Escalation (CVE-2026-41702) (https://thehackernews.com/2026/05/ivanti-fortinet-sap-vmware-n8n-patch.html) - n8n Critical Prototype Pollution and RCE (https://thehackernews.com/2026/05/ivanti-fortinet-sap-vmware-n8n-patch.html) - Azure Local Disconnected Operations Privilege Escalation (CVE-2026-42822) (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822) CVEs Referenced: CVE-2026-20127, CVE-2026-20182, CVE-2026-26083, CVE-2026-34260, CVE-2026-34263, CVE-2026-41702, CVE-2026-42231, CVE-2026-42232, CVE-2026-42822, CVE-2026-42897, CVE-2026-44277, CVE-2026-44791, CVE-2026-45321, CVE-2026-8043 Indicators of Compromise: Domains: m-kosche[.]com, mlcrosoft[.]co Full brief: https://carolinacleartech.com/brief/2026-05-19/