Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

23 KEV additions. 9+ critical CVEs. What security teams must prioritise in June.

CISA added 23 vulnerabilities to the catalog, spanning remote-access tooling, enterprise applications, network hardware, and CMS plugins. The month's defining pattern isn't raw RCE — it's authentication and access-control failures, which account for nearly a third of all additions and gave attackers a way in without needing a code-execution bug at all. Vulnerability managers, detection engineers, and CISOs need this report to separate the handful of entries carrying real operational urgency — confirmed ransomware links, MSP-scale blast radius, zero-day exploitation — from the rest of the list.

The Month in Numbers

Figures above reflect independent verification against vendor advisories and CISA KEV alerts conducted for this report. The 14 lower-priority entries not individually cited below should still be checked against live NVD records before publishing final CVSS figures.

Priority Vulnerabilities This Month

Ranked by operational risk, not CVSS alone.

Note on scope: the remaining 14 June KEV additions (Lantronix EDS5000, Widget Factory Joomla Content Editor, LiteSpeed cPanel Plugin, two additional Cisco Catalyst SD-WAN Manager CVEs, Ivanti Sentry, Google Chromium V8, Arista EOS, BerriAI LiteLLM, SolarWinds Serv-U, Mirasvit Full Page Cache Warmer, Linux Kernel, Android Framework, and Oracle WebLogic Server) are all confirmed KEV entries but did not carry the same combination of ransomware attribution, supply-chain blast radius, or zero-day timing that drove the ranking above. Full CVE-by-CVE detail for these is in the weekly reports linked below.

This Month's Weekly KEV Reports — Full Index

Only the 29 June weekly article was confirmed via search for this report. Confirm and insert the remaining four weekly article links directly from the CMS before publishing — this dataset doesn't include your internal weekly-post archive, so I can't verify their exact titles or slugs from here.

Threat Landscape Context

The defining shift this month is the balance between access-control failures and code-execution bugs: seven of 23 entries are authentication or access-control bypasses, edging out the injection/RCE category (six entries) as the largest single class. That matters operationally — organisations that tune detection primarily around RCE indicators (webshells, unusual process spawning) may be under-instrumented for the "walk in the front door with a forged token" pattern that defined SimpleHelp, Check Point, Oracle PeopleSoft, and Splunk this month. Two vendors tied for most entries — Cisco and Ubiquiti, both with three — but for different reasons: Cisco's spread across Unified CM and two separate SD-WAN Manager CVEs suggests broad platform scrutiny rather than a single flawed component, while Ubiquiti's three bugs shipped in one advisory, meaning any exposed UniFi deployment is carrying compounding risk from a single patch cycle. Notably absent from this month's list: no major cloud-identity provider entries, despite that category dominating recent months — a gap worth tracking rather than assuming resolved. The cumulative picture: June's KEV additions read less like isolated CVEs and more like a coordinated reminder that credential and session validation, not just code execution, is where 2026's attackers are finding the cheapest path in.

Sector Exposure Summary

Hackerstorm Analysis

The industry is under-weighting authentication-bypass vulnerabilities relative to RCE, and this month's data argues that's backwards. Seven of 23 entries didn't need a code-execution bug at all — a forged OIDC token, a certificate-validation logic flaw, or a missing-auth endpoint got attackers just as far, often faster, because these bypasses are frequently invisible to detection rules tuned for webshells and process anomalies. The Splunk entry deserves particular attention independent of its CVSS score: when the vulnerability sits in the SIEM itself, "detect and respond" stops being a reliable fallback, because the detection layer is the thing that's compromised. We'd also flag the Check Point timeline specifically — a full month of active, ransomware-linked exploitation before a patch existed is a pattern worth tracking across vendors, not treating as a one-off. Organisations scoring this month's KEV list purely on CVSS will patch Ubiquiti and Mirasvit (both 9.8–10.0) before Check Point (9.3) — and get the priority order wrong, because zero-day timing and confirmed ransomware attribution matter more than a 0.5–0.7 point CVSS gap.

Further Reading

🔗 CVSS vs EPSS: How to Prioritise Vulnerabilities by Real Exploitation Risk
Why read this: Directly extends this month's ranking logic — the priority table above uses the same exploitation-first, attribution-aware methodology over static CVSS ordering.

🔗 Vulnerability Backlog: Why CVSS Prioritisation Is Broken and How to Fix It
Why read this: Companion piece on why EPSS + KEV + asset reachability outperforms CVSS-only triage — relevant given the Check Point vs. Ubiquiti ranking discussed above.

🔗 Vulnerability Management: Operational Risk & Exposure-Based Prioritization
Why read this: Practical exposure/reachability framework for triaging a 23-entry month like this one without treating every CVSS-9+ entry as equally urgent.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NVD: https://nvd.nist.gov/
• CISA Alert (PTC Windchill/FlexPLM, Cisco UCM): https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CISA Alert (Cisco SD-WAN, LiteSpeed): https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CISA Alert (Splunk Enterprise): https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-adds-one-known-exploited-vulnerability-catalog
• Check Point Security Advisory (CVE-2026-50751): https://support.checkpoint.com/results/sk/sk185033
• Vendor advisory for each CVE — see individual notes fields in the source KEV feed
• The Hacker News, SecurityWeek, Help Net Security, Rapid7, and HivePro reporting used for exploitation context and attribution (Qilin, ShinyHunters) cited above