Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 1 Known Exploited Vulnerability to Catalog (June 16, 2026)

Source: CISA KEV Catalog · Updated 2026-09-25

Summary

On June 16, 2026, CISA added 1 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-48907. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Widget Factory · Joomla Content Editor

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Federal due date
2026-06-19
Ransomware use
Unknown
Added
2026-06-16

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

Also added to KEV in June 2026

  • June 29, 2026: CVE-2026-48558, SimpleHelp SimpleHelp (SimpleHelp Authentication Bypass Vulnerability)
  • June 25, 2026: CVE-2026-20230, Cisco Unified Communications Manager (Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerab)
  • June 25, 2026: CVE-2026-12569, PTC Windchill and FlexPLM (PTC Windchill and FlexPLM Improper Input Validation Vulnerability)
  • June 23, 2026: CVE-2026-34910, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Input Validation Vulnerability)
  • June 23, 2026: CVE-2026-34909, Ubiquiti UniFi OS (Ubiquiti UniFi OS Path Traversal Vulnerability)
  • June 23, 2026: CVE-2026-34908, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Access Control Vulnerability)
  • June 23, 2026: CVE-2025-67038, Lantronix EDS5000 (Lantronix EDS5000 Code Injection Vulnerability)
  • June 18, 2026: CVE-2026-20253, Splunk Enterprise (Splunk Enterprise Missing Authentication for Critical Function Vulnerability)
  • June 15, 2026: CVE-2026-54420, LiteSpeed cPanel Plugin (LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability)
  • June 15, 2026: CVE-2026-20262, Cisco Catalyst SD-WAN Manager (Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability)
  • June 12, 2026: CVE-2026-35273, Oracle PeopleSoft Enterprise PeopleTools (Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Fun)
  • June 11, 2026: CVE-2026-10520, Ivanti Sentry (Ivanti Sentry OS Command Injection Vulnerability)
  • June 9, 2026: CVE-2026-7473, Arista Extensible Operating System (Arista Extensible Operating System Incomplete Comparison with Missing Factors Vu)
  • June 9, 2026: CVE-2026-20245, Cisco Catalyst SD-WAN Manager (Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerabil)
  • June 9, 2026: CVE-2026-11645, Google Chromium V8 (Google Chromium V8 Out-of-Bounds Read and Write Vulnerability)
  • June 8, 2026: CVE-2026-50751, Check Point Security Gateway (Check Point Security Gateway Improper Authentication Vulnerability)
  • June 8, 2026: CVE-2026-42271, BerriAI LiteLLM (BerriAI LiteLLM Command Injection Vulnerability)
  • June 5, 2026: CVE-2026-28318, SolarWinds Serv-U (SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability)
  • June 3, 2026: CVE-2026-45247, Mirasvit Mirasvit Full Page Cache Warmer (Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability)
  • June 2, 2026: CVE-2025-48595, Android Framework (Android Framework Integer Overflow Vulnerability)
  • June 2, 2026: CVE-2022-0492, Linux Kernel (Linux Kernel Improper Authentication Vulnerability)
  • June 1, 2026: CVE-2024-21182, Oracle WebLogic Server (Oracle WebLogic Server Unspecified Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.