Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 2 Known Exploited Vulnerabilities to Catalog (June 15, 2026)

Source: CISA KEV Catalog · Updated 2026-09-25

Summary

On June 15, 2026, CISA added 2 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-54420, CVE-2026-20262. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-54420: LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

LiteSpeed · cPanel Plugin

LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

Federal due date
2026-06-18
Ransomware use
Unknown
Added
2026-06-15

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Cisco · Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

Federal due date
2026-06-29
Ransomware use
Unknown
Added
2026-06-15

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Cisco KEV history

Also added to KEV in June 2026

  • June 29, 2026: CVE-2026-48558, SimpleHelp SimpleHelp (SimpleHelp Authentication Bypass Vulnerability)
  • June 25, 2026: CVE-2026-20230, Cisco Unified Communications Manager (Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerab)
  • June 25, 2026: CVE-2026-12569, PTC Windchill and FlexPLM (PTC Windchill and FlexPLM Improper Input Validation Vulnerability)
  • June 23, 2026: CVE-2026-34910, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Input Validation Vulnerability)
  • June 23, 2026: CVE-2026-34909, Ubiquiti UniFi OS (Ubiquiti UniFi OS Path Traversal Vulnerability)
  • June 23, 2026: CVE-2026-34908, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Access Control Vulnerability)
  • June 23, 2026: CVE-2025-67038, Lantronix EDS5000 (Lantronix EDS5000 Code Injection Vulnerability)
  • June 18, 2026: CVE-2026-20253, Splunk Enterprise (Splunk Enterprise Missing Authentication for Critical Function Vulnerability)
  • June 16, 2026: CVE-2026-48907, Widget Factory Joomla Content Editor (Widget Factory Joomla Content Editor Improper Access Control Vulnerability)
  • June 12, 2026: CVE-2026-35273, Oracle PeopleSoft Enterprise PeopleTools (Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Fun)
  • June 11, 2026: CVE-2026-10520, Ivanti Sentry (Ivanti Sentry OS Command Injection Vulnerability)
  • June 9, 2026: CVE-2026-7473, Arista Extensible Operating System (Arista Extensible Operating System Incomplete Comparison with Missing Factors Vu)
  • June 9, 2026: CVE-2026-20245, Cisco Catalyst SD-WAN Manager (Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerabil)
  • June 9, 2026: CVE-2026-11645, Google Chromium V8 (Google Chromium V8 Out-of-Bounds Read and Write Vulnerability)
  • June 8, 2026: CVE-2026-50751, Check Point Security Gateway (Check Point Security Gateway Improper Authentication Vulnerability)
  • June 8, 2026: CVE-2026-42271, BerriAI LiteLLM (BerriAI LiteLLM Command Injection Vulnerability)
  • June 5, 2026: CVE-2026-28318, SolarWinds Serv-U (SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability)
  • June 3, 2026: CVE-2026-45247, Mirasvit Mirasvit Full Page Cache Warmer (Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability)
  • June 2, 2026: CVE-2025-48595, Android Framework (Android Framework Integer Overflow Vulnerability)
  • June 2, 2026: CVE-2022-0492, Linux Kernel (Linux Kernel Improper Authentication Vulnerability)
  • June 1, 2026: CVE-2024-21182, Oracle WebLogic Server (Oracle WebLogic Server Unspecified Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.