Vulnerability Report – Week 22 of May 2026

Analyst Guidance

This week's verified threat landscape is dominated by three actively exploited vulnerabilities affecting web platforms and infrastructure. CVE-2026-48172 in LiteSpeed cPanel Plugin poses immediate risk with CVSS 10.0 and active exploitation. CVE-2026-9082 affecting Drupal Core has been added to CISA's Known Exploited Vulnerabilities catalog and is under active attack. Security teams should prioritize patching these critical flaws immediately, with particular attention to any externally facing systems.

Patch Priority Matrix

critical

LiteSpeed User-End cPanel Plugin CVE-2026-48172 is under active exploitation allowing arbitrary script execution with root privileges. Maximum severity (CVSS 10.0) requires immediate patching.

CVE-2026-48172

critical

Drupal Core SQL injection vulnerability CVE-2026-9082 (CVSS 6.5) is actively exploited and now tracked in CISA KEV catalog. All supported Drupal Core versions are affected.

CVE-2026-9082

high

Ghost CMS SQL injection flaw CVE-2026-26980 is being exploited at scale in ClickFix phishing campaigns to inject malicious JavaScript. Organizations running Ghost should update urgently.

CVE-2026-26980

high

OpenSSL vulnerability CVE-2022-4304 affects Hitachi Energy GMS600 products. Vendors should verify third-party component versions and apply available updates.

CVE-2022-4304

CVE Details & Remediation

How to read this report

Verified facts — NVD & CISA KEV Partially verified — awaiting NVD enrichment AI analysis — synthesis, verify before acting

Actionable · Verified facts

NVD-published · CISA KEV cross-checked

🛡️CVE-2026-48172 – Litespeedtech Litespeed Cpanel Plugin ✓ NVD

CVSS9.8 NVD 3.1

StatusActive Exploit

Exploitation In CISA KEV

ActionPatch immediately

Remediation Steps

Apply the latest security patch from LiteSpeed for the cPanel Plugin immediately
Verify that only authorized cPanel users have access to affected systems
Review system logs for evidence of exploitation or unauthorized script execution
Restrict cPanel administrative access to trusted networks where feasible

References:

🛡️CVE-2026-9082 – Drupal Drupal ✓ NVD

CVSS9.8 NVD 3.1

StatusActive Exploit

Exploitation In CISA KEV

ActionPatch immediately

Remediation Steps

Update all supported Drupal Core versions to the latest patched release immediately
Review database query logs for evidence of SQL injection attempts
Ensure database user accounts are restricted to minimum required privileges
Monitor for malicious activity on systems running affected Drupal versions

References:

🛡️CVE-2026-26980 – Ghost Ghost ✓ NVD

CVSS9.4 NVD 3.1

StatusActive Exploit

Exploitation Reported exploitation

ActionPatch immediately

AffectedMedia

Remediation Steps

Apply the latest Ghost CMS security update that addresses the SQL injection vulnerability
Audit Ghost instances for injected malicious JavaScript in content
Review user activity logs for signs of compromise or unauthorized modifications
Implement Content Security Policy (CSP) headers to mitigate JavaScript injection impact

References:

🛡️CVE-2022-4304 – Openssl Openssl ✓ NVD

CVSS5.9 NVD 3.1

StatusUnder Review

ActionPatch this week

AffectedEnergy

Remediation Steps

Contact Hitachi Energy for the latest GMS600 firmware that addresses the OpenSSL vulnerability
Review the version of OpenSSL bundled in your GMS600 deployment against known vulnerable releases
Plan a maintenance window for firmware update deployment
Test the update in a non-production environment before deploying to operational systems

References:

Editorial integrity

Verified facts (green zone): 4 CVE ID(s) verified verbatim against source articles; 1 confirmed exploited in CISA KEV; 2 with source-reported exploitation (KEV-pending).

Partially verified (yellow zone): 4 CVE(s) have real IDs in source articles but NVD has not yet finished enrichment. This is normal for vulnerabilities disclosed within the last 1–3 days. We re-check NVD daily and the page auto-updates when canonical data arrives.

AI-synthesized content (analyst summary, remediation step phrasing): generated by an AI model from 5 security feeds. Generic remediation guidance (apply patch, restrict network access, monitor logs) is best-practice and trusted; specific vendor steps and version numbers must be verified against the official advisories linked above. Verify before acting in production.

Adjustments before publication: 3 unverified claim(s) stripped or genericized.

Find an error? contact@defend.network

Updated 2026-05-26: NVD canonical data arrived for CVE-2022-4304; moved into Verified Facts.

Updated 2026-05-27: NVD canonical data arrived for CVE-2026-48172, CVE-2026-26980; moved into Verified Facts.

Updated 2026-05-28: NVD canonical data arrived for CVE-2026-48172, CVE-2026-9082; moved into Verified Facts.

🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.

Vulnerability Priority Report – Week 22 of May 2026

Analyst Guidance

Patch Priority Matrix

CVE Details & Remediation

🛡️CVE-2026-48172 – Litespeedtech Litespeed Cpanel Plugin ✓ NVD

Remediation Steps

🛡️CVE-2026-9082 – Drupal Drupal ✓ NVD

Remediation Steps

🛡️CVE-2026-26980 – Ghost Ghost ✓ NVD

Remediation Steps

🛡️CVE-2022-4304 – Openssl Openssl ✓ NVD

Remediation Steps

Get Weekly Vulnerability Reports