Good morning. This is your security briefing for Friday, May 15, 2026. We're covering three articles today. All attribution is by the article authors, and all article analysis is automated.
CISA has added a critical Cisco Catalyst SD-WAN Manager vulnerability to the Known Exploited Vulnerabilities catalog. The authentication bypass flaw, with a maximum severity score of ten point zero, allows unauthenticated remote attackers to gain full administrative privileges by sending crafted requests to a specific network port. The vulnerability is actively being exploited by threat actors targeting internet-exposed SD-WAN management interfaces, and organizations must immediately upgrade to fixed software releases and review their control logs for signs of compromise.
Check Point Research has analyzed The Gentlemen ransomware-as-a-service operation after their internal database was compromised in May 2026, exposing operational details of nine core accounts. The group became the second most productive ransomware operation in early 2026 with approximately three hundred thirty-two victims in five months, targeting high-value corporate entities globally and reusing stolen data to pressure multiple victims.
Security researchers have disclosed YellowKey, a vulnerability that allows attackers with physical access to bypass BitLocker disk encryption on Windows 11 and recent Windows Server versions. The flaw exploits the Windows Recovery Environment by placing specific files in a system directory, then triggering an elevated shell during recovery that grants unrestricted access to protected volumes. The researcher suspects this may be an intentional backdoor due to the suspicious presence of the vulnerable code only in the recovery environment and not in standard Windows installations.
That concludes today's briefing.