U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog

CVE-2026-20262 is a directory/path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager, the central management component of Cisco's enterprise SD-WAN solution. An authenticated, remote attacker can supply crafted input containing traversal sequences that escape the intended directory, allowing the attacker to create a new file or overwrite any file on the affected system's filesystem. Overwriting arbitrary files can enable configuration tampering, persistence, or privilege escalation on the management appliance depending on which file is targeted. Any organization running Cisco Catalyst SD-WAN Manager is affected, with greatest risk where the management interface is reachable by broad user populations or from the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-15, indicating exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, CVSS is not yet scored, and EPSS assigns a 28.2% probability of exploitation within 30 days (98th percentile).

Do: Apply the fixed release per Cisco's advisory (specific fixed versions are not provided in this data set, so consult Cisco's security notice) and follow CISA's KEV required action, including BOD 26-04 timelines for federal agencies and cloud service use. Until patched, restrict access to the SD-WAN Manager management interface to trusted management networks, enforce strong authentication, and audit the filesystem for unexpectedly created or recently modified files that could indicate exploitation. Evaluate each instance's internet exposure and prioritize internet-reachable management appliances for immediate remediation.

The LiteSpeed cPanel plugin, as distributed through the LiteSpeed WHM plugin, before version 2.4.8 (WHM plugin 5.3.2.0) mishandles UNIX symbolic links supplied by users (CWE-61). An attacker who already has FTP or web shell access to any account on a shared hosting server running CloudLinux/CageFS can plant a crafted symlink that the privileged plugin follows, letting them act beyond their own account scope — reportedly gaining root control of the entire server (CVSS scope change, C:H/I:H/A:H). Any hosting provider running vulnerable versions of the LiteSpeed cPanel/WHM plugin is affected, and because this is shared hosting, a single malicious tenant endangers other customers on the same server. The flaw was exploited in the wild in May 2026, was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-15 (BOD 26-04 remediation obligations apply), and has a 1.4% 30-day EPSS; no public proof-of-concept is known.

Do: Upgrade the LiteSpeed cPanel plugin to 2.4.8 or later via the LiteSpeed WHM plugin 5.3.2.0 or later, following vendor instructions to meet CISA KEV/BOD 26-04 timelines. Until patched, restrict or monitor FTP and web shell access on affected shared hosting servers and review logs for signs of privilege escalation during and since May 2026; if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use.