Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 15 to 21 June 2026 (week 25)
Final report, published . It does not change.
In the week of 15 to 21 June 2026, 4 vulnerabilities were newly recorded as exploited in the wild, 4 of them critical. The technology hit most was Cisco Catalyst SD-WAN Manager (1), followed by Joomla! Project Jce-Editor (1) and LiteSpeed Technologies cPanel Plugin (1).
- Newly exploited
- 4
- Critical
- 4
- Technologies hit
- 7
Newly exploited this week
- CVE-2026-20253: Splunk Enterprise auth bypass in PostgreSQL sidecar servicecriticalCVSS 9.8Exploited since Published Splunk Cloud Platform, Splunk Enterprise
- CVE-2026-48907: Joomla JCE Editor improper access control leading to RCEcriticalCVSS 10Exploited since Published Joomla! Project Jce-Editor, Widget Factory Joomla Content Editor
- CVE-2026-20262: Cisco Catalyst SD-WAN Manager arbitrary file write in web UIcriticalCVSS 6.5Exploited since Published Cisco Catalyst SD-WAN Manager
- CVE-2026-54420: LiteSpeed cPanel plugin privilege escalation via symlink followingcriticalCVSS 8.5Exploited since Published LiteSpeed Technologies cPanel Plugin, LiteSpeed Technologies WHM Plugin
Technologies hit most
- 1.Cisco Catalyst SD-WAN Manager1 vulnerability
- 2.Joomla! Project Jce-Editor1 vulnerability
- 3.LiteSpeed Technologies cPanel Plugin1 vulnerability
- 4.LiteSpeed Technologies WHM Plugin1 vulnerability
- 5.Splunk Cloud Platform1 vulnerability
- 6.Splunk Enterprise1 vulnerability
- 7.Widget Factory Joomla Content Editor1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-06-15.json, and this page as text at https://junglewise.ai/threats/exploited/2026-06-15.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 15 to 21 June 2026 (week 25)", https://junglewise.ai/threats/exploited/2026-06-15, 2 October 2026.