CVE-2026-20182
Get tomorrow's brief in your inbox
Today: The Supreme Court unanimously ruled that freight brokers can face state negligent hiring lawsuits despite federal preemption claims. CISA gave federal agencies until Sunday to patch a critical authentication bypass in Cisco SD-WAN systems (CVE-2026-20182, CVSS 10.0). Two banking class action settlements ($2.25M Bank of America, $1M Equity Bank) address overdraft and ATM fee practices.
CISA Emergency Directive on Cisco SD-WAN Vulnerability (CVE-2026-20182)
CISA ordered all federal agencies to patch CVE-2026-20182, a critical authentication bypass vulnerability in Cisco SD-WAN systems, by Sunday, May 18. The bug carries a 10.0 CVSS severity score and allows unauthenticated remote attackers to bypass authentication and obtain administrative privileges. Incident responders from Rapid7 discovered the vulnerability while investigating a similar February bug. The flaw behaves like a master key, allowing attackers to present themselves as trusted network routers without proper validation. CISA coordinated the February emergency directive with Five Eyes intelligence agencies warning of active exploitation by an advanced threat actor. The vulnerability is ideal for nation-state pre-positioning because SD-WAN controllers sit in the middle of trust relationships most organizations rarely question.
DOJ Accuses Yale Medical School of Race-Based Admissions Discrimination
The Department of Justice accused Yale School of Medicine of violating anti-discrimination laws by favoring Black and Hispanic applicants over more qualified white and Asian students. Assistant Attorney General for Civil Rights Harmeet Dhillon stated that Yale was subverting the 2023 Supreme Court decision overturning race-conscious admissions policies by relying on proxies such as life experiences and cultural events to determine applicant ethnicity. Dhillon emphasized that applicant-level data provided by Yale shows virtually no difference in racial preferences before and after the Supreme Court ruling. Yale responded that admitted students demonstrate exceptional academic achievement and personal commitment and expressed confidence in its rigorous admissions process.
DC Appeals Court Blocks ICE's Seven-Day Advance Notice Detention Inspection Policy
A three-judge panel of the DC Circuit Court of Appeals unanimously ruled that the Trump administration must continue allowing congressional members to inspect immigration detention facilities without advance notice. The decision preserves Democrats' ability to make unannounced visits to detention centers. DHS Secretary Kristi Noem had issued guidance claiming the Big Beautiful Bill freed ICE from congressional inspection requirements and attempted to impose 72-hour to seven-day advance notice requirements. Judge Rao wrote that the government is entitled to deference on facility security but the current record does not substantiate claims that oversight visits without advance notice impose harms beyond administrative inconvenience. The Big Beautiful Act funding rider that DHS relied on lapsed during the shutdown and has not been re-attached.
Supreme Court Rules Freight Brokers Face State Negligent Hiring Suits (Montgomery v. Caribe Transport II)
The Supreme Court unanimously held in Montgomery v. Caribe Transport II that federal law does not shield freight brokers from state lawsuits claiming they negligently hired dangerous motor carriers. Shawn Montgomery suffered severe injuries including leg amputation when a tractor-trailer driven by Yosniel Varela-Mojena for Caribe Transport II rear-ended his stopped vehicle on Illinois Interstate 70. Montgomery sued freight broker C.H. Robinson, arguing the broker was liable because it knew or should have known Caribe Transport II was an unsafe choice. Federal regulators had given the carrier a conditional safety rating when C.H. Robinson hired it, finding deficiencies in driver qualification, hours of service, and crash rates. C.H. Robinson moved to dismiss, arguing the Federal Aviation Administration Authorization Act of 1994 (FAAAA) preempts state laws related to motor carrier services. Justice Amy Coney Barrett, writing for the 9-0 court, held that Section 14501(c)(2)(A) of the FAAAA exempts the safety regulatory authority of a state with respect to motor vehicles from preemption. Barrett interpreted "with respect to" as "concerns" or "regards" based on ordinary dictionary definitions and noted that common-law duties and standards of care form part of a state's authority to regulate safety.
Supreme Court Validates Federal Court Authority to Confirm Arbitration Awards (Jules v. Andre Balazs Properties)
The Supreme Court unanimously held in Jules v. Andre Balazs Properties that federal courts with original jurisdiction over a case retain authority to confirm or vacate arbitration awards under the Federal Arbitration Act (FAA) Sections 9 and 10. Justice Sonia Sotomayor wrote that when a case is already pending in federal court based on federal question or diversity jurisdiction, the court may assess jurisdiction by looking at the suit already before it rather than "looking through" the arbitration motion as required in freestanding FAA cases. The decision distinguishes 2022's Badgerow v. Walters, which held that federal courts cannot entertain freestanding suits under the FAA to confirm or vacate arbitration awards absent independent federal jurisdiction. Sotomayor emphasized that nothing in the FAA eliminates federal jurisdiction while parties arbitrate, so when parties return to court after arbitration with Section 9 and 10 motions, the court retains the same jurisdiction it possessed from the start.
$2.25M Bank of America 7-Eleven ATM Fees Class Action Settlement
Bank of America agreed to a $2.25 million class action settlement resolving claims that the bank charged multiple out-of-network fees at 7-Eleven ATMs. Affected accountholders will receive cash payments or fee credits.
$1M Equity Bank Overdraft Fees Class Action Settlement
Equity Bank reached a $1 million class action settlement resolving claims over overdraft and nonsufficient funds fees. Eligible accountholders may automatically receive cash payments or fee forgiveness.
Santa Clara County Sues Meta for Profiting from Scam Ads
Santa Clara County filed a lawsuit alleging Meta knowingly profits from scam ads on Facebook and Instagram while falsely claiming to combat them. The suit claims the company's ad approval processes are inadequate and allow fraudulent advertisements to reach users despite internal knowledge of the scam activity.
Supreme Court Denies Virginia Democratic Request to Reinstate Congressional Map
The Supreme Court denied a request by Virginia Attorney General Jay Jones and Democratic legislators to allow the state to use a new congressional map expected to strongly favor Democrats in the 2026 elections. The Virginia Supreme Court struck down the map on May 8, ruling the General Assembly did not follow correct procedures when putting the constitutional amendment enabling the map on the ballot. The state constitution requires the Legislature to approve proposed amendments during two different legislative sessions separated by an election to the House of Delegates. The majority found that although the Legislature voted on the amendment on October 31, 2025, more than 1.3 million votes had already been cast, meaning the vote occurred well after the 2025 general election had begun. Virginia Governor Abigail Spanberger had already indicated the state would not use the 2026 map in upcoming elections.
Internet Addiction Verdicts Against Apple, Meta, YouTube Draw Criticism
Recent internet addiction verdicts against Apple, Meta, and YouTube secured only $6 million in damages despite plaintiffs requesting billions, representing approximately 0.5% of the amount sought. The legal theory attempts to work around Section 230 by shifting focus from user content to product design, arguing that features like infinite scroll or like buttons create harm independent of users' content. The Computer & Communications Industry Association (CCIA) warned that these cases create litigation exposure unique to U.S. companies and act as an innovation tax on American firms, particularly small and early-stage companies. CCIA noted that roughly 80% of its members are small or early-stage companies that cannot absorb years of litigation risk, causing startups to pull back, new features to go unbuilt, and investment to shift away from risk.
Supreme Court Extends Abortion Pill Mail Access
The Supreme Court granted requests from Danco Laboratories and GenBioPro to pause a ruling by the U.S. Court of Appeals for the 5th Circuit that reinstated a requirement that mifepristone be dispensed only in person. The order preserves mail-order access to the abortion pill while litigation continues. Justices Clarence Thomas and Samuel Alito wrote dissenting opinions.
Watchdog Groups Call for Alito Investigation Over Oil Stock Conflicts
A coalition of watchdog organizations sent a letter to the Senate Judiciary Committee asking lawmakers to investigate Justice Samuel Alito's holdings in energy companies. The groups urged him to recuse himself from a case to be argued next term on efforts to hold oil companies liable for damages allegedly caused by climate change. Earlier this year, Alito recused himself from a case brought by Louisiana parishes seeking to hold oil and gas companies liable for damage to the Louisiana coast due to his financial interest in ConocoPhillips.
Trump $10 Billion IRS Lawsuit May Become $1.7 Billion MAGA Slush Fund
President Trump is expected to drop his $10 billion lawsuit against the IRS in exchange for creation of a $1.7 billion fund to compensate allies who claim they were wrongfully targeted by the Biden administration. The commission overseeing the compensation fund would have authority to distribute approximately $1.7 billion in taxpayer funds to settle claims from anyone who alleges harm by the Biden administration's weaponization of the legal system, including nearly 1,600 individuals charged in connection with the January 6 Capitol attack and entities associated with Trump himself. The lawsuit stemmed from a contractor (already convicted and serving in prison) leaking tax returns Trump had promised to release but never did. The judge overseeing the case, Kathleen Williams, expressed concern that the settlement looked like a single party negotiating with itself over how much of the Treasury it should receive.
Patch Cisco SD-WAN systems immediately. CVE-2026-20182 is a critical authentication bypass (CVSS 10.0) under active exploitation by nation-state actors. Federal agencies have until Sunday, May 18. Private sector organizations should treat this as a critical priority. Follow CISA's February emergency directive: identify all SD-WAN systems, collect logs, hunt for compromise indicators.
Freight brokers must implement rigorous carrier vetting procedures. The Supreme Court's ruling in Montgomery v. Caribe Transport II confirms that state negligent hiring laws apply despite FAAAA preemption arguments. Review federal safety ratings, crash rates, driver qualifications, and hours-of-service compliance before contracting with motor carriers. Document your vetting process.
Higher education institutions should audit admissions processes. The DOJ's action against Yale Medical School shows the government is actively investigating whether schools use proxy factors (life experiences, cultural references, essay topics) to circumvent the 2023 Supreme Court ban on race-conscious admissions. Document decision criteria and maintain applicant-level data showing decisions are made independently of race.
Federal courts retain arbitration award enforcement authority. Jules v. Andre Balazs Properties confirms that if your case is already in federal court based on federal question or diversity jurisdiction, the court can confirm or vacate arbitration awards under FAA Sections 9 and 10 without needing independent federal jurisdiction for those motions.
Banking institutions should review ATM and overdraft fee practices. The Bank of America $2.25M and Equity Bank $1M settlements demonstrate continued enforcement risk for multiple out-of-network fees and overdraft/NSF fee practices. Review fee structures, disclosure practices, and automated fee assessment logic.