June 2026 CVE Landscape
- CVEs
- CVE-2026-35616CVE-2026-25939CVE-2020-17103CVE-2022-0492CVE-2025-55182CVE-2025-67038CVE-2025-8088CVE-2026-10520CVE-2026-11645CVE-2026-12569CVE-2026-20230CVE-2026-20245CVE-2026-20253CVE-2026-20262CVE-2026-21509CVE-2026-28318CVE-2026-33825CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-35273CVE-2026-39808CVE-2026-41089CVE-2026-42271CVE-2026-48558CVE-2026-48907CVE-2026-50751CVE-2026-54420CVE-2026-7473CVE-2021-26855CVE-2021-36260CVE-2022-40684CVE-2023-20198CVE-2024-21182CVE-2024-21762CVE-2025-48595CVE-2025-6218CVE-2026-21513CVE-2026-3300CVE-2026-41091CVE-2026-44963CVE-2026-45247CVE-2016-4437CVE-2021-27076CVE-2021-27137CVE-2022-27925CVE-2022-41082CVE-2023-32315CVE-2023-46747CVE-2024-36401CVE-2026-25089CVE-2026-39813CVE-2026-4020CVE-2026-46817CVE-2026-5027CVE-2026-8206
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-4437 | Unauthenticated RCE via hard-coded cipher key in Apache Shiro 'remember me' | 9.8 | 93% | KEVPoC | KEV |
| CVE-2020-17103 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | 7.0 | 27% | ||
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2021-27076 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 | 14% | ||
| CVE-2021-27137 | Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH) | 8.1 | 4% | KEVPoC ×4 | KEV |
| CVE-2021-36260 | Unauthenticated Command Injection in Hikvision Device Web Server | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2022-0492 | Linux Kernel Cgroups v1 release_agent Privilege Escalation and Container Escape | 7.8 | 6% | KEVPoC | KEV |
| CVE-2022-27925 | Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite | 7.2 | 99% | KEVRansomwarePoC | KEV |
| CVE-2022-40684 | Admin-Interface Auth Bypass in Fortinet FortiOS, FortiProxy & FortiSwitchManager | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-41082 | Authenticated RCE in Microsoft Exchange Server (ProxyNotShell) | 8.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-20198 | Unauthenticated Privilege Escalation in Cisco IOS XE Web UI (Actively Exploited) | 10.0 | 100% | KEV | KEV |
| CVE-2023-32315 | Unauthenticated Path Traversal in Ignite Realtime Openfire Admin Console | 7.5 | 100% | KEVPoC ×2 | KEV |
| CVE-2023-46747 | F5 BIG-IP TMUI Authentication Bypass Enables Unauthenticated RCE | 9.8 | 97% | KEVRansomwarePoC ×2 | KEV |
| CVE-2024-21182 | Unauthenticated Data Exposure in Oracle WebLogic Server via T3/IIOP | 7.5 | 74% | KEV | KEV |
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-48595 | Integer Overflow Local Privilege Escalation in Android Framework | 8.4 | 2% | KEV | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-6218 | Directory Traversal RCE in RARLAB WinRAR | 7.8 | 90% | KEVPoC ×2 | KEV |
| CVE-2025-67038 | Unauthenticated Root Command Injection in Lantronix EDS5000 Device Servers | 9.3 | 20% | KEV | KEV |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution | 8.4 | 94% | KEVRansomware | KEV |
| CVE-2026-10520 | Unauthenticated OS Command Injection in Ivanti Sentry | 10.0 | 100% | KEVPoC | KEV |
| CVE-2026-11645 | Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution | 8.8 | 2% | KEVPoC | KEV |
| CVE-2026-12569 | Unauthenticated RCE in PTC Windchill and FlexPLM | 9.3 | 46% | KEVRansomware | KEV |
| CVE-2026-20230 | SSRF in Cisco Unified Communications Manager Enables Root Escalation | 8.6 | 88% | KEVPoC | KEV |
| CVE-2026-20245 | Command Injection as Root in Cisco Catalyst SD-WAN Manager | 7.8 | 25% | KEV | KEV |
| CVE-2026-20253 | Unauthenticated RCE in Splunk Enterprise via PostgreSQL sidecar endpoint | 9.8 | 97% | KEVPoC | KEV |
| CVE-2026-20262 | Authenticated Path Traversal File Overwrite in Cisco Catalyst SD-WAN Manager | 6.5 | 29% | KEV | KEV |
| CVE-2026-21509 | Local Security Feature Bypass in Microsoft Office Under Active Exploitation | 7.8 | 71% | KEV | KEV |
| CVE-2026-21513 | MSHTML Security Feature Bypass in Windows Exploited in the Wild (CVE-2026-21513) | 8.8 | 16% | KEV | KEV |
| CVE-2026-25089 | Unauthenticated OS Command Injection RCE in Fortinet FortiSandbox | 9.8 | 76% | KEV | KEV |
| CVE-2026-25939 | FUXA: An authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary… | 9.3 | 12% | ||
| CVE-2026-28318 | Unauthenticated DoS in SolarWinds Serv-U via crafted Content-Encoding: deflate POSTs | 7.5 | 44% | KEV | KEV |
| CVE-2026-3300 | Unauthenticated RCE via PHP Code Injection in Everest Forms Pro WordPress Plugin | 9.8 | 39% | ||
| CVE-2026-33825 | Local Privilege Escalation in Microsoft Defender Antimalware Platform | 7.8 | 7% | KEVRansomwarePoC | KEV |
CVE-2026-34910+2 related CVEs | Unauthenticated Command Injection in Ubiquiti UniFi OS Devices | 10.0 | 90% | KEVPoC | KEV |
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
| CVE-2026-35616 | Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6 | 9.8 | 94% | KEVPoC | KEV |
CVE-2026-39808+1 related CVE | Unauthenticated OS Command Injection in Fortinet FortiSandbox 4.4 | 9.8 | 93% | KEVPoC ×3 | KEV |
| CVE-2026-4020 | Unauthenticated Sensitive Data Exposure in Gravity SMTP WordPress Plugin | 7.5 | 40% | ||
| CVE-2026-41089 | Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089) | 9.8 | 80% | PoC ×6 | |
| CVE-2026-41091 | Link-Following Local Privilege Escalation in Microsoft Defender (Actively Exploited) | 7.8 | 8% | KEVPoC | KEV |
| CVE-2026-42271 | Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild | 8.7 | 91% | KEV | KEV |
| CVE-2026-44963 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user | 9.4 | 2% | PoC | |
| CVE-2026-45247 | Unauthenticated Deserialization RCE in Mirasvit Full Page Cache Warmer | 9.3 | 26% | KEV | KEV |
| CVE-2026-46817 | Unauthenticated Takeover of Oracle Payments in Oracle E-Business Suite (CVE-2026-46817) | 9.8 | 12% | KEV | KEV |
| CVE-2026-48558 | Authentication Bypass via Forged OIDC Tokens in SimpleHelp | 9.5 | 78% | KEV | KEV |
| CVE-2026-48907 | Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE) | 10.0 | 85% | KEVPoC ×3 | KEV |
| CVE-2026-5027 | Authenticated Path Traversal Arbitrary File Write in Langflow Files API | 8.8 | 36% | ||
| CVE-2026-50751 | Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways | 9.3 | 85% | KEVRansomwarePoC | KEV |
| CVE-2026-54420 | Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild | 8.5 | 1% | KEV | KEV |
| CVE-2026-7473 | Incomplete Tunnel Protocol Verification in Arista EOS Exploited in the Wild | 6.9 | 1% | KEV | KEV |
| CVE-2026-8206 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… | 9.8 | 1% | PoC |
From the original article
6 min read at recordedfuture.com
In June 2026, Insikt Group® identified 59 high-impact vulnerabilities that should be prioritized for remediation , 30 of which had a Very Critical Recorded Future Risk Score. This represents a 47% increase from last month.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.