CISA KEV · June 2026
In June 2026, CISA added 23 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 21 in May 2026. 3 entries are known to be used in ransomware campaigns. The most affected vendors were Cisco (3), Ubiquiti (3), Oracle (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 29 Jun 2026 | CVE-2026-48558 | SimpleHelp Authentication Bypass VulnerabilitySimpleHelp · SimpleHelp | |
| 25 Jun 2026 | CVE-2026-20230 | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityCisco · Unified Communications Manager | |
| 25 Jun 2026 | CVE-2026-12569 | PTC Windchill and FlexPLM Improper Input Validation VulnerabilityRANSOMWAREPTC · Windchill and FlexPLM | |
| 23 Jun 2026 | CVE-2026-34910 | Ubiquiti UniFi OS Improper Input Validation VulnerabilityUbiquiti · UniFi OS | |
| 23 Jun 2026 | CVE-2026-34909 | Ubiquiti UniFi OS Path Traversal VulnerabilityUbiquiti · UniFi OS | |
| 23 Jun 2026 | CVE-2026-34908 | Ubiquiti UniFi OS Improper Access Control VulnerabilityUbiquiti · UniFi OS | |
| 23 Jun 2026 | CVE-2025-67038 | Lantronix EDS5000 Code Injection VulnerabilityLantronix · EDS5000 | |
| 18 Jun 2026 | CVE-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function VulnerabilitySplunk · Enterprise | |
| 16 Jun 2026 | CVE-2026-48907 | Widget Factory Joomla Content Editor Improper Access Control VulnerabilityWidget Factory · Joomla Content Editor | |
| 15 Jun 2026 | CVE-2026-54420 | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityLiteSpeed · cPanel Plugin | |
| 15 Jun 2026 | CVE-2026-20262 | Cisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityCisco · Catalyst SD-WAN Manager | |
| 12 Jun 2026 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityRANSOMWAREOracle · PeopleSoft Enterprise PeopleTools | |
| 11 Jun 2026 | CVE-2026-10520 | Ivanti Sentry OS Command Injection VulnerabilityIvanti · Sentry | |
| 9 Jun 2026 | CVE-2026-7473 | Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityArista · Extensible Operating System | |
| 9 Jun 2026 | CVE-2026-20245 | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output VulnerabilityCisco · Catalyst SD-WAN Manager | |
| 9 Jun 2026 | CVE-2026-11645 | Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityGoogle · Chromium V8 | |
| 8 Jun 2026 | CVE-2026-50751 | Check Point Security Gateway Improper Authentication VulnerabilityRANSOMWARECheck Point · Security Gateway | |
| 8 Jun 2026 | CVE-2026-42271 | BerriAI LiteLLM Command Injection VulnerabilityBerriAI · LiteLLM | |
| 5 Jun 2026 | CVE-2026-28318 | SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilitySolarWinds · Serv-U | |
| 3 Jun 2026 | CVE-2026-45247 | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityMirasvit · Mirasvit Full Page Cache Warmer | |
| 2 Jun 2026 | CVE-2025-48595 | Android Framework Integer Overflow VulnerabilityAndroid · Framework | |
| 2 Jun 2026 | CVE-2022-0492 | Linux Kernel Improper Authentication VulnerabilityLinux · Kernel | |
| 1 Jun 2026 | CVE-2024-21182 | Oracle WebLogic Server Unspecified VulnerabilityOracle · WebLogic Server |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
23 vulnerabilities. In May 2026 it added 21.
Cisco, with 3 entries. Next were Ubiquiti (3), Oracle (2), SimpleHelp (1).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →