# Newly exploited vulnerabilities: week of 8 to 14 June 2026 (week 24)

Source: https://junglewise.ai/threats/exploited/2026-06-08  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-06-08.json  
License: CC BY 4.0 with a link back

In the week of 8 to 14 June 2026, 7 vulnerabilities were newly recorded as exploited in the wild, 7 of them critical. The technology hit most was Arista EOS (1), followed by Berriai LiteLLM (1) and Check Point Mobile Access VPN (1).

## Newly exploited this week

- [CVE-2026-35273: Oracle PeopleSoft PeopleTools compromise in Updates Environment Management](https://junglewise.ai/threats/cve-2026-35273-oracle-peoplesoft-peopletools-compromise-in-updates-environment) (critical, exploited in the wild, CVSS 9.8, exploited since 12 Jun 2026, published 11 Jun 2026)
- [CVE-2026-10520: Ivanti Sentry OS command injection allows remote code execution](https://junglewise.ai/threats/cve-2026-10520-ivanti-sentry-os-command-injection-allows-remote-code-execution) (critical, exploited in the wild, CVSS 10, exploited since 11 Jun 2026, published 9 Jun 2026)
- [CVE-2026-11645: Google Chrome V8 out of bounds read and write](https://junglewise.ai/threats/cve-2026-11645-google-chrome-v8-out-of-bounds-read-and-write) (critical, exploited in the wild, CVSS 8.8, exploited since 9 Jun 2026, published 9 Jun 2026)
- [CVE-2026-7473: Arista EOS improper tunnel protocol verification in decapsulation](https://junglewise.ai/threats/cve-2026-7473-arista-eos-improper-tunnel-protocol-verification-in-decapsulation) (critical, exploited in the wild, CVSS 5.8, exploited since 9 Jun 2026, published 5 Jun 2026)
- [CVE-2026-20245: Cisco Catalyst SD-WAN Manager privilege escalation in CLI](https://junglewise.ai/threats/cve-2026-20245-cisco-catalyst-sd-wan-manager-privilege-escalation-in-cli) (critical, exploited in the wild, CVSS 7.8, exploited since 9 Jun 2026, published 4 Jun 2026)
- [CVE-2026-50751: Check Point VPN authentication bypass in IKEv1 key exchange](https://junglewise.ai/threats/cve-2026-50751-check-point-vpn-authentication-bypass-in-ikev1-key-exchange) (critical, exploited in the wild, CVSS 9.8, exploited since 8 Jun 2026, published 8 Jun 2026)
- [CVE-2026-42271: BerriAI LiteLLM OS command injection in MCP test endpoints](https://junglewise.ai/threats/cve-2026-42271-berriai-litellm-os-command-injection-in-mcp-test-endpoints) (critical, exploited in the wild, CVSS 8.8, exploited since 8 Jun 2026, published 8 May 2026)

## Technologies hit most

1. [Arista EOS](https://junglewise.ai/threats/technologies/eos): 1 vulnerability
2. [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm): 1 vulnerability
3. Check Point Mobile Access VPN: 1 vulnerability
4. Check Point Remote Access VPN: 1 vulnerability
5. [Check Point Security Gateway](https://junglewise.ai/threats/technologies/security-gateway): 1 vulnerability
6. [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager): 1 vulnerability
7. [Google Chrome](https://junglewise.ai/threats/technologies/chrome): 1 vulnerability
8. [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8): 1 vulnerability
9. [Ivanti Sentry](https://junglewise.ai/threats/technologies/sentry): 1 vulnerability
10. [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm): 1 vulnerability
11. [Microsoft Edge](https://junglewise.ai/threats/technologies/edge-chromium-based): 1 vulnerability
12. [Opera Software Opera-Browser](https://junglewise.ai/threats/technologies/opera): 1 vulnerability
13. [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 8 to 14 June 2026 (week 24)", https://junglewise.ai/threats/exploited/2026-06-08, 2 October 2026.