Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 2 Known Exploited Vulnerabilities to Catalog (June 25, 2026)

Source: CISA KEV Catalog · Updated 2026-09-25

Summary

On June 25, 2026, CISA added 2 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-12569, CVE-2026-20230. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

PTC · Windchill and FlexPLM

PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

Federal due date
2026-06-28
Ransomware use
Known
Added
2026-06-25

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record

CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Cisco · Unified Communications Manager

Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.

Federal due date
2026-06-28
Ransomware use
Unknown
Added
2026-06-25

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Cisco KEV history

Also added to KEV in June 2026

  • June 29, 2026: CVE-2026-48558, SimpleHelp SimpleHelp (SimpleHelp Authentication Bypass Vulnerability)
  • June 23, 2026: CVE-2026-34910, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Input Validation Vulnerability)
  • June 23, 2026: CVE-2026-34909, Ubiquiti UniFi OS (Ubiquiti UniFi OS Path Traversal Vulnerability)
  • June 23, 2026: CVE-2026-34908, Ubiquiti UniFi OS (Ubiquiti UniFi OS Improper Access Control Vulnerability)
  • June 23, 2026: CVE-2025-67038, Lantronix EDS5000 (Lantronix EDS5000 Code Injection Vulnerability)
  • June 18, 2026: CVE-2026-20253, Splunk Enterprise (Splunk Enterprise Missing Authentication for Critical Function Vulnerability)
  • June 16, 2026: CVE-2026-48907, Widget Factory Joomla Content Editor (Widget Factory Joomla Content Editor Improper Access Control Vulnerability)
  • June 15, 2026: CVE-2026-54420, LiteSpeed cPanel Plugin (LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability)
  • June 15, 2026: CVE-2026-20262, Cisco Catalyst SD-WAN Manager (Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability)
  • June 12, 2026: CVE-2026-35273, Oracle PeopleSoft Enterprise PeopleTools (Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Fun)
  • June 11, 2026: CVE-2026-10520, Ivanti Sentry (Ivanti Sentry OS Command Injection Vulnerability)
  • June 9, 2026: CVE-2026-7473, Arista Extensible Operating System (Arista Extensible Operating System Incomplete Comparison with Missing Factors Vu)
  • June 9, 2026: CVE-2026-20245, Cisco Catalyst SD-WAN Manager (Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerabil)
  • June 9, 2026: CVE-2026-11645, Google Chromium V8 (Google Chromium V8 Out-of-Bounds Read and Write Vulnerability)
  • June 8, 2026: CVE-2026-50751, Check Point Security Gateway (Check Point Security Gateway Improper Authentication Vulnerability)
  • June 8, 2026: CVE-2026-42271, BerriAI LiteLLM (BerriAI LiteLLM Command Injection Vulnerability)
  • June 5, 2026: CVE-2026-28318, SolarWinds Serv-U (SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability)
  • June 3, 2026: CVE-2026-45247, Mirasvit Mirasvit Full Page Cache Warmer (Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability)
  • June 2, 2026: CVE-2025-48595, Android Framework (Android Framework Integer Overflow Vulnerability)
  • June 2, 2026: CVE-2022-0492, Linux Kernel (Linux Kernel Improper Authentication Vulnerability)
  • June 1, 2026: CVE-2024-21182, Oracle WebLogic Server (Oracle WebLogic Server Unspecified Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.