NewsCompaniesFlawsGuides
Get the app

Flaws added in June 2026

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in June 2026. For the newest, see Exploited flaws.

In June 2026, CISA added 23 flaws to its list of vulnerabilities being used in attacks, 2 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Cisco (3), Ubiquiti (3) and Oracle (2).[1]

About a third let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in June 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

1 added

CVEFlawFound
CVE-2026-48558At work SimpleHelp. Attackers can get into SimpleHelp without a valid password. At work

2 added

CVEFlawFound
CVE-2026-20230At work Cisco Unified Communications Manager. Attackers can make Cisco Unified Communications Manager send requests into the network behind it from anywhere, without logging in. At work
CVE-2026-12569† Used in ransomwareAt work PTC Windchill and FlexPLM. Attackers can run their own code on PTC Windchill and FlexPLM from anywhere, without logging in. At work

4 added

CVEFlawFound
CVE-2026-34910At work Ubiquiti UniFi OS. Attackers can run commands on Ubiquiti UniFi OS. At work
CVE-2026-34909At work Ubiquiti UniFi OS. Attackers can read files on Ubiquiti UniFi OS that should be out of reach. At work
CVE-2026-34908At work Ubiquiti UniFi OS. Attackers can reach parts of Ubiquiti UniFi OS that should be locked to them. At work
CVE-2025-67038At work Lantronix EDS5000. Attackers can run their own code on Lantronix EDS5000. At work

1 added

CVEFlawFound
CVE-2026-20253At work Splunk Enterprise. Attackers can get into Splunk Enterprise without a valid password. At work

1 added

CVEFlawFound
CVE-2026-48907At work Widget Factory Joomla Content Editor. Attackers can reach parts of Widget Factory Joomla Content Editor that should be locked to them from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2026-54420At work LiteSpeed cPanel Plugin. Attackers are using a flaw in LiteSpeed cPanel Plugin. At work
CVE-2026-20262At work Cisco Catalyst SD-WAN Manager. Attackers can read files on Cisco Catalyst SD-WAN Manager that should be out of reach. At work

1 added

CVEFlawFound
CVE-2026-35273† Used in ransomwareAt work Oracle PeopleSoft Enterprise PeopleTools. Attackers can get into Oracle PeopleSoft Enterprise PeopleTools without a valid password. At work

1 added

CVEFlawFound
CVE-2026-10520At work Ivanti Sentry. Attackers can run their own code on Ivanti Sentry from anywhere, without logging in. At work

3 added

CVEFlawFound
CVE-2026-7473At work Arista Extensible Operating System. Attackers are using a flaw in Arista Extensible Operating System. At work
CVE-2026-20245At work Cisco Catalyst SD-WAN Manager. Opening a booby-trapped file can let an attacker run their own code through Cisco Catalyst SD-WAN Manager. At work
CVE-2026-11645At home Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. At home

2 added

CVEFlawFound
CVE-2026-50751† Used in ransomwareAt work Check Point Security Gateway. Attackers can get into Check Point Security Gateway without a valid password. At work
CVE-2026-42271At work BerriAI LiteLLM. Someone who already has a way in can use BerriAI LiteLLM to run their own code. At work

1 added

CVEFlawFound
CVE-2026-28318At work SolarWinds Serv-U. Attackers can crash SolarWinds Serv-U or stop it working from anywhere, without logging in. At work

1 added

CVEFlawFound
CVE-2026-45247At work Mirasvit Full Page Cache Warmer. Attackers can run their own code on Mirasvit Full Page Cache Warmer from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2025-48595At home Android Framework. Attackers can run their own code on Android Framework. At home
CVE-2022-0492At work Linux Kernel. Someone who already has a foothold can use Linux Kernel to take full control of the machine. At work

1 added

CVEFlawFound
CVE-2024-21182At work Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server that its maker hasn't described in detail. At work

Companies

The flaws were in 18 companies’ products; the most were in Cisco’s (3).

CompanyFlawsRansomware
Cisco3–
Ubiquiti3–
Oracle21
Android1–
Arista1–
BerriAI1–
Check Point11
Google1–
Ivanti1–
Lantronix1–
Linux1–
LiteSpeed1–
Mirasvit1–
PTC11
SimpleHelp1–
3 others3

Other months

Every month since CISA started the list; June 2026 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.