Zero-day report: June 2026
CISA added 23 exploited vulnerabilities to its catalog in June 2026, 2 more than May (21). 11 were zero-days, listed within a week of going public. 3 are known to be used by ransomware. The most-hit vendor was Cisco, with 3.
By technology
Most-hit vendors
Every flaw added in June 2026
- SimpleHelp · SimpleHelpSimpleHelp Authentication Bypass Vulnerability
- PTC · Windchill and FlexPLMPTC Windchill and FlexPLM Improper Input Validation Vulnerability
- Cisco · Unified Communications ManagerCisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
- Lantronix · EDS5000Lantronix EDS5000 Code Injection Vulnerability
- Ubiquiti · UniFi OSUbiquiti UniFi OS Improper Access Control Vulnerability
- Ubiquiti · UniFi OSUbiquiti UniFi OS Path Traversal Vulnerability
- Ubiquiti · UniFi OSUbiquiti UniFi OS Improper Input Validation Vulnerability
- Splunk · EnterpriseSplunk Enterprise Missing Authentication for Critical Function Vulnerability
- Widget Factory · Joomla Content Editor Widget Factory Joomla Content Editor Improper Access Control Vulnerability
- Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
- LiteSpeed · cPanel PluginLiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
- Oracle · PeopleSoft Enterprise PeopleToolsOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- Ivanti · SentryIvanti Sentry OS Command Injection Vulnerability
- Google · Chromium V8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
- Arista · Extensible Operating SystemArista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
- BerriAI · LiteLLMBerriAI LiteLLM Command Injection Vulnerability
- Check Point · Security GatewayCheck Point Security Gateway Improper Authentication Vulnerability
- SolarWinds · Serv-USolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
- Mirasvit · Mirasvit Full Page Cache WarmerMirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability
- Linux · KernelLinux Kernel Improper Authentication Vulnerability
- Android · FrameworkAndroid Framework Integer Overflow Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server Unspecified Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.