Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack

Part of the CVE-2026-20262 story · since 15 Jun

Quiet for 19 weekslast report 16 Jun9 articles4 outlets
15 Jun · SecurityOnline first23 Aug15 Sep8 OctNowThis article7th of 9
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV. This article, 7th of 9.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20262 and CVE-2026-54420. CVE-2026-20262, with a CVSS score of 6.5, affects the Cisco Catalyst SD-WAN Manager, allowing attackers to exploit file upload vulnerabilities if they have valid low-privileged user credentials.

CVE-2026-54420, with a CVSS score of 8.5, pertains to the LiteSpeed cPanel plugin and enables privilege escalation via symbolic link mishandling, impacting shared hosting servers. Recent exploitation of these vulnerabilities has been confirmed, leading CISA to mandate federal agencies to address them by specific due dates (June 18 and June 29, 2026). Administrators are urged to check server logs and upgrade to the patched versions of the LiteSpeed WHM Plugin.

How the story developed

All 9 articles
Quiet for 19 weekslast report 16 Jun9 articles4 outlets

9 articles from 4 outlets since 15 Jun. Quiet since 16 Jun. This was the 7th report, 15 hours after the first.

Now15 Jun16171829 OctFirst reportSecurityOnline · 15 Jun, 18:09This article7th of 9 · day 1
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV. This article, 7th of 9.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Mon 15 JunDay 03
    1. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now18:09 · SecurityOnline · First report · Known exploited CVE
    2. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list19:41 · CISA · official · CISA alert · Known exploited CVE
    3. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list20:17 · CISA · official · Known exploited CVE
  2. Tue 16 JunDay 16
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks06:30 · SecurityWeek · Known exploited CVE
    3. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE · This article, 7th of 9
    Show 3 more from 16 Jun
    1. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    2. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
    3. Cisco SD WAN manager flaw lets attackers write files, patch urged11:30 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in