CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand.
If you read nothing else
- Palo Alto firewalls had two exploited flaws in May. If you own one, confirm both fixes or mitigations are in place.
- On-premises Exchange had an exploited email flaw. Keep the emergency mitigation on until the update is installed.
- If anyone installed DAEMON Tools Lite between April 8 and May 5, treat that PC as infected.
Six things from May. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. A firewall flaw gave attackers root
On May 6, Palo Alto Networks warned of CVE-2026-0300 (CVSS 9.3), a buffer overflow in the PAN-OS User-ID Authentication Portal, also called Captive Portal, that lets an attacker run code as root on PA-Series and VM-Series firewalls without logging in. Exploitation was limited and aimed at portals reachable from the internet. Fixes were due May 13 or May 28 depending on version. Source: Security Affairs, May 6.
CISA added it to the Known Exploited Vulnerabilities list the same day. Source: CISA KEV catalog.
What this means for you: the device meant to keep attackers out was the way in.
Do this: if you have a Palo Alto firewall, make sure the Captive Portal is reachable only from trusted internal addresses, and install the fixed version.
2. A second Palo Alto flaw opened VPN sessions
CVE-2026-0257 (CVSS 7.8) let attackers set up an unauthorized GlobalProtect VPN connection on firewalls using authentication override cookies with a specific certificate setup. Palo Alto published it May 13; Rapid7 saw exploitation waves starting May 17 and May 21. CISA added it to its exploited list with a June 1 federal deadline. Source: The Hacker News, May 30.
What this means for you: a flaw first rated medium became a working way into networks within days.
Do this: ask your IT provider to either turn off the authentication override feature or give it its own certificate, then patch.
3. One email could attack on-premises Exchange
In mid-May, Microsoft warned that CVE-2026-42897, a cross-site scripting flaw in on-premises Exchange Server 2016, 2019 and Subscription Edition, was being exploited. A crafted email opened in Outlook Web Access could run attacker code in the browser. Exchange Online was not affected. The Exchange Emergency Mitigation Service applied a fix automatically where enabled; a full update followed on June 10, but for Exchange 2016 and 2019 only for customers in Microsoft's paid extended support program. Source: Help Net Security, May 15.
What this means for you: if you still run your own Exchange server, you carry this risk yourself; Microsoft 365 customers did not.
Do this: confirm the Emergency Mitigation Service is on and the June update is installed. If you cannot get the update, plan the move to a supported mail service.
4. A real download site served a trojanized installer
Official DAEMON Tools Lite installers for Windows (versions 12.5.0.2421 through 12.5.0.2434), downloaded from the vendor's own site between about April 8 and May 5, had malware built in after attackers got into the vendor's build or distribution systems. CISA added it to its exploited list on May 27. Source: NIST NVD, CVE-2026-8398.
What this means for you: a signed installer from the right website was still poisoned.
Do this: find any PC with DAEMON Tools Lite, uninstall it, run a full antivirus scan, and only reinstall version 12.6 or newer if it is really needed for work.
5. Ransomware claims dipped, manufacturing led
Breachsense counted 646 victims claimed on ransomware leak sites in May, down from 772 in April. Qilin led with 101, followed by TheGentlemen (70) and Akira (52). Manufacturing was the most hit industry with 58 victims, and 39% of victims were in the US. These are claims, not confirmed breaches. Source: Breachsense May 2026 report.
What this means for you: manufacturers were the top target, not an afterthought.
Do this: keep an offline backup and have someone restore a test file from it this month.
6. CMMC: Phase 2 dates stood
As May closed, CMMC Phase 1 had been in effect since November 10, 2025, and Phase 2 was scheduled to take effect on November 10, 2026. (On July 13, after this issue went out, the Department of War suspended Phase 2 pending a 60 day review; see the note at the top.) Source: WilmerHale client alert, July 20.
What this means for you: self-assessment and SPRS obligations were already live for defense suppliers.
Do this: check that the score you posted in SPRS matches what your System Security Plan actually says is in place.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.