5 min read

Threat Report 5/18/26

Evan Kennedy : May 16, 2026 8:25:16 AM

#zeroday #apple #microsoft #adobe #mozilla #windows
Threat Report 5/18/26

Microsoft Security Advisory:
Critical Vulnerabilities Affecting Multiple Products

 

Microsoft has released security updates addressing multiple vulnerabilities across several widely used products, including Windows, Microsoft Office, and Microsoft Edge. The most severe vulnerabilities could allow for remote code execution (RCE), enabling attackers to take control of affected systems remotely.

Successful exploitation could allow an attacker to gain the same privileges as the currently logged-on user. Depending on the user’s permission level, an attacker may be able to:

  • Install malicious software
  • View, modify, or delete sensitive data
  • Create unauthorized accounts with full administrative privileges
  • Move laterally across connected systems and networks

Systems where users operate with administrative rights face significantly greater risk than environments enforcing least-privilege access controls.

 

Affected Systems

A broad range of Microsoft products are impacted, including but not limited to:

  • Microsoft Windows
  • Microsoft Office
  • Microsoft Edge
  • Additional Microsoft enterprise and productivity platforms

Organizations should review Microsoft’s official advisories to determine exposure within their environments.

 

Business Risk Assessment

  • Large and medium business entities: High
  • Small business entities: Medium

 

Recommended Actions

1. Apply Microsoft Security Updates Immediately

Ensure all Microsoft products and supported systems are updated with the latest available security patches.

2. Enforce the Principle of Least Privilege

Restrict administrative access to only users who require elevated permissions. Limiting user privileges can significantly reduce the impact of successful exploitation.

3. Review Endpoint Security Controls

Verify antivirus, endpoint detection and response (EDR), and patch management systems are functioning properly and actively monitoring for suspicious activity.

4. Monitor for Indicators of Compromise

Review logs and security alerts for abnormal behavior, unauthorized account creation, privilege escalation attempts, or unexpected software installations.

 

References

 

 

Critical Apple Security Updates Released
Immediate Action Recommended

 

Apple has released a series of security updates addressing multiple vulnerabilities across iPhone, iPad, Mac, Apple Watch, Apple TV, and Vision Pro devices. Several of these vulnerabilities are considered critical and could allow attackers to execute arbitrary code on affected systems.

If successfully exploited, attackers may be able to:

  • Install malicious programs
  • View, modify, or delete sensitive data
  • Create new accounts with elevated privileges
  • Gain broader access depending on the user’s permission level

Devices operated with administrative privileges are at significantly greater risk than those following least-privilege practices.

 

Affected Systems

The following versions are vulnerable and should be updated immediately:

  • iOS and iPadOS versions prior to 26.5
  • iOS and iPadOS versions prior to 18.7.9
  • iPadOS versions prior to 17.7.11
  • iOS and iPadOS versions prior to 16.7.16
  • iOS and iPadOS versions prior to 15.8.8
  • macOS Tahoe versions prior to 26.5
  • macOS Sequoia versions prior to 15.7.7
  • macOS Sonoma versions prior to 14.8.7
  • tvOS versions prior to 26.5
  • watchOS versions prior to 26.5
  • visionOS versions prior to 26.5

 

Business Risk Assessment

  • Large and medium business entities: High
  • Small business entities: Medium

 

Recommended Actions

Organizations and users should take the following steps immediately:

1. Apply Security Updates

Ensure all Apple devices are updated to the latest available software versions.

2. Enforce Least Privilege

Limit administrative privileges to only users who require elevated access. Reducing unnecessary permissions can significantly lessen the impact of exploitation attempts.

3. Review Device Management Policies

Verify mobile device management (MDM) and endpoint management solutions are enforcing current patch compliance across the environment.

4. Monitor for Suspicious Activity

Review endpoint logs and security alerts for unusual behavior, unauthorized account creation, or unexpected application installations.

 

Official Apple References



Critical Adobe Security Vulnerabilities Discovered:

Immediate Patching Recommended

 

Adobe has released security updates addressing multiple vulnerabilities across a wide range of products, including Adobe Commerce, Premiere Pro, Illustrator, After Effects, and several Creative Cloud and developer SDK offerings. The most severe vulnerabilities could allow attackers to execute arbitrary code on affected systems.

Successful exploitation could enable attackers to run malicious code in the context of the logged-on user. Depending on the privileges assigned to that account, an attacker could potentially:

  • Install malware or unauthorized applications
  • Access, modify, or delete sensitive data
  • Create new accounts with elevated privileges
  • Compromise enterprise environments through lateral movement

Systems where users operate with administrative privileges face significantly higher risk than those enforcing least-privilege access controls.

 

Affected Systems

The following Adobe products are affected, including but not limited to:

  • Adobe After Effects
  • Adobe Commerce
  • Adobe Commerce B2B
  • Adobe Connect Desktop Application
  • Adobe Media Encoder
  • Adobe Premiere / Premiere Pro
  • Adobe Substance 3D Designer
  • Adobe Substance 3D Painter
  • Adobe Substance 3D Sampler
  • Adobe Illustrator
  • Magento Open Source
  • Content Authenticity SDKs (JavaScript and Rust)

Organizations should review all installed Adobe products and verify versions against Adobe’s published security advisories.

 

Business Risk Assessment

  • Large and medium business entities: High
  • Small business entities: Medium

 

Recommended Actions

1. Apply Adobe Security Updates Immediately

Ensure all Adobe products are updated to the latest supported versions as soon as possible.

2. Enforce the Principle of Least Privilege

Restrict administrative access to only users who require elevated permissions. Reducing privilege levels can significantly lessen the impact of successful exploitation.

3. Review Endpoint and Email Security Controls

Many Adobe-related attacks rely on malicious files, phishing emails, or crafted documents. Ensure endpoint protection and email filtering solutions are active and properly configured.

4. Monitor for Suspicious Activity

Review logs and alerts for unusual application behavior, unauthorized installations, privilege escalation attempts, or suspicious file execution activity.

 

Additional Threat Context

Adobe has recently addressed several high-severity vulnerabilities capable of arbitrary code execution, including flaws impacting Acrobat and Reader products that were reportedly exploited in the wild through malicious PDF files. Security researchers have warned that these vulnerabilities may be leveraged in phishing and targeted attack campaigns.

 

Official Adobe References

 

Critical Mozilla Vulnerabilities Discovered

Immediate Updates Recommended

 

Mozilla has released security updates addressing multiple vulnerabilities affecting Firefox and Firefox ESR (Extended Support Release). The most severe vulnerabilities could allow for arbitrary code execution, potentially enabling attackers to execute malicious code on vulnerable systems.

Successful exploitation could allow an attacker to operate with the same privileges as the logged-on user. Depending on the user’s permission level, an attacker may be able to:

  • Install malicious software
  • View, modify, or delete sensitive data
  • Create unauthorized accounts with elevated privileges
  • Compromise enterprise systems or user environments

Devices where users maintain administrative privileges are at significantly greater risk than those operating under least-privilege security models.

 

Affected Systems

The following Mozilla products are affected:

  • Firefox versions prior to 150.0.2
  • Firefox ESR versions prior to 140.10.2
  • Firefox ESR versions prior to 115.35.2

Organizations and users running unsupported or outdated browser versions may be vulnerable to exploitation through malicious websites or crafted web content.

 

Business Risk Assessment

  • Large and medium business entities: High
  • Small business entities: Medium

 

Recommended Actions

1. Apply Mozilla Security Updates Immediately

Ensure all Firefox and Firefox ESR installations are updated to the latest available versions.

2. Enforce the Principle of Least Privilege

Restrict administrative access to only users who require elevated permissions. Reducing user privileges can significantly limit the impact of successful exploitation.

3. Strengthen Browser Security Controls

Review browser security configurations, extension policies, and endpoint protection measures to reduce exposure to malicious web content.

4. Monitor for Suspicious Activity

Watch for indicators such as unexpected browser crashes, unauthorized software installations, abnormal network connections, or suspicious account activity.

 

Additional Threat Context

Browsers remain one of the most commonly targeted attack surfaces for cybercriminals due to their constant interaction with untrusted content. Threat actors frequently exploit browser vulnerabilities through phishing campaigns, malicious advertisements, and compromised websites to gain initial access into enterprise environments.

Prompt patching and strong endpoint security practices remain critical to reducing exposure.

 

Official References

 

Disgruntled Researcher Discloses Two Windows Zero-Days

 

An anonymous security researcher known as "Nightmare-Eclipse" released two Windows zero-days just after Microsoft's Patch Tuesday updates, the Register reports. The first vulnerability, dubbed "YellowKey," is a BitLocker bypass that allows an attacker with physical access to obtain root access on a machine. While the need for physical access lessens the scope of the flaw, Rik Ferguson, VP of security intelligence at Forescout, noted, "If [the researcher's claim] holds up, a stolen laptop stops being a hardware problem and becomes a breach notification." The flaw can be mitigated with a BitLocker PIN and a BIOS password lock.

The second vulnerability, dubbed "GreenPlasma," is a privilege escalation flaw that can allow attackers to obtain SYSTEM privileges. The researcher published a proof-of-concept exploit without the code needed to reach SYSTEM.

Nightmare-Eclipse is a disgruntled researcher who appears to be running a retaliatory campaign against Microsoft. The individual disclosed three additional Windows zero-days earlier this year.