Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV

May 27, 2026 · Original article ↗

Summary

Proofpoint telemetry observed 12 distinct 2026 CVEs in network-facing exploitation, four absent from CISA KEV as of May 15. The report says familiar opportunistic tactics persist as CVE volume and NVD enrichment backlogs complicate prioritization.

Key points

Proofpoint reports that telemetry from more than 5,000 sensors detected exploitation attempts or successful exploitation events involving 12 distinct 2026 CVEs; CISA KEV listed eight as of May 15, 2026.
Proofpoint observed TA422 (APT28) weaponize CVE-2026-21509 in malicious RTF files within 24 hours of disclosure, targeting Ukrainian government and European organizations.
In two campaigns, Proofpoint says TA406 (Opal Sleet) chained CVE-2026-21509 and CVE-2026-21510: RTF-delivered LNK files triggered WebDAV downloads before CVE-2026-21510 was used to bypass Windows Shell protections and execute a DLL.
Proofpoint reports TA422 exploited CVE-2026-32202, stemming from an incomplete patch, alongside CVE-2026-21513 in attacks beginning in late 2025; Microsoft acknowledged active exploitation in April 2026.
Proofpoint observed mass exploitation attempts involving cPanel CVE-2026-41940, with activity including ransomware, defacement, and, in at least one reported case, espionage.
The report says Q1 2026 CVE submissions to NIST were nearly one-third higher than a year earlier, while NVD enrichment backlogs grew. It attributes the rise in vulnerability discovery primarily to defenders and researchers using AI, and says attacker tradecraft remains largely opportunistic.
Proofpoint recommends prioritizing network-facing vulnerabilities based on exploitation telemetry rather than waiting for CISA KEV listing or relying on CVSS scores alone.

Article Details

Publisher: Proofpoint
Report Period: 2026 year-to-date; CISA KEV comparison as of 2026-05-15
Scope: Targeted email campaigns and network-facing CVE exploitation observed in Proofpoint telemetry.
Sample Size: More than 5,000 passive network sensors and over 3 million alerts analyzed; email telemetry covers hundreds of millions of messages daily.
Key Statistics: Proofpoint observed active exploitation attempts involving 12 distinct 2026 CVEs in network telemetry; CISA KEV listed 8 as of 2026-05-15.
Four of the 12 CVEs observed in network telemetry were not on the CISA KEV list as of 2026-05-15.
TA422 weaponized CVE-2026-21509 within 24 hours of public disclosure, according to Proofpoint.
Proofpoint estimates 55,000–60,000 CVEs will be published across 2026.
The report cites a 42% year-over-year increase in zero-days exploited before public disclosure, attributed to the CrowdStrike 2026 Global Threat Report.
Recommendations: Prioritize newly disclosed network-facing authentication-bypass and remote-code-execution vulnerabilities without waiting for CISA KEV listing, especially when public PoC code is available.
Patch Microsoft Office and Windows urgently, particularly for zero-days, and apply Microsoft’s registry-hardening guidance.
Augment or replace CVSS-centric prioritization with telemetry on active exploitation.
Apply exposure scrutiny to AI developer platforms, including those with broad network access or sensitive credential stores.
Plan response SLAs on the assumption that high-severity remotely exploitable vulnerabilities with public PoCs may be attempted within 48–72 hours of disclosure.