CISA Adds Cisco SD-WAN and LiteSpeed cPanel Flaws to KEV Catalog
CISA has added CVE-2026-20262 (Cisco Catalyst SD-WAN Manager path traversal) and CVE-2026-54420 (LiteSpeed cPanel symlink following) to its Known Exploited Vulnerabilities catalog, citing active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog with two new entries: CVE-2026-20262 affecting Cisco Catalyst SD-WAN Manager and CVE-2026-54420 impacting the LiteSpeed cPanel plugin. Both vulnerabilities carry evidence of active exploitation, prompting CISA to mandate remediation for federal agencies under Binding Operational Directive (BOD) 26-04.
CVE-2026-20262 is a directory or path traversal vulnerability in Cisco Catalyst SD-WAN Manager, a component widely deployed for managing software-defined wide area networks. Successful exploitation could allow an unauthenticated attacker to read arbitrary files or execute commands on the underlying system. Cisco has released security updates to address the flaw, and organizations are urged to apply patches immediately.
CVE-2026-54420 is a UNIX symbolic link (symlink) following vulnerability in the LiteSpeed cPanel plugin, a popular tool for web hosting environments. The flaw enables an attacker with limited access to create a symlink that points to sensitive files, potentially leading to privilege escalation or unauthorized data access. LiteSpeed has provided a patched version of the plugin, and hosting providers are advised to update their installations without delay.
CISA's addition of these vulnerabilities to the KEV catalog aligns with BOD 26-04, which replaced the earlier BOD 22-01. The updated directive requires Federal Civilian Executive Branch (FCEB) agencies to prioritize remediation of KEV-listed CVEs on publicly exposed assets that grant total control post-exploitation. Agencies must also check for signs of compromise before applying patches, ensuring that any prior intrusion is detected and addressed.
While BOD 26-04 applies only to FCEB agencies, CISA strongly encourages all organizations—including private sector entities—to adopt risk-based vulnerability management practices. The agency continues to accept nominations for new KEV entries via its online form, provided the submission includes a valid CVE ID, evidence of exploitation, and clear mitigation guidance.
The inclusion of these two flaws underscores the persistent threat posed by known vulnerabilities that remain unpatched. Attackers frequently target such weaknesses to gain initial access or escalate privileges, often within hours of public disclosure. Organizations that fail to prioritize remediation of KEV-listed CVEs risk falling victim to ransomware, data theft, or network compromise.
CISA's KEV catalog now contains hundreds of entries, serving as a critical resource for defenders seeking to focus their patching efforts on the most dangerous vulnerabilities. The addition of CVE-2026-20262 and CVE-2026-54420 reinforces the importance of timely updates and proactive monitoring in an increasingly hostile threat landscape.
The Register reports that Cisco shipped patches for CVE-2026-20262 on the same day CISA added it to the KEV catalog, with the vendor confirming limited exploitation was already underway in June 2026. The medium-severity file-upload flaw (CVSS 6.8) requires only lower-privileged credentials, enabling attackers to overwrite arbitrary files and escalate to root privileges across all SD-WAN Manager deployment types. This is the eighth Cisco SD-WAN bug added to CISA's KEV catalog this year, arriving less than two weeks after a separate SD-WAN zero-day (CVE-2026-20245) was also exploited in the wild.
New reporting from Cyber Security News provides additional technical details on the exploitation of CVE-2026-20262, including specific Indicators of Compromise (IOCs) such as suspicious WAR file uploads logged in vmanage-server.log and serviceproxy-access.log. Cisco has released patches across multiple software branches (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2) and notes that the vulnerability was discovered during internal security testing before being observed in limited real-world attacks. The article also clarifies that while SD-WAN traffic handling is not directly affected, compromise of the management plane could allow attackers to manipulate configurations or maintain persistent access.
New technical details from the advisory reveal that the exploit chain relies on abusing the generateEcCert and packageUserSize API calls in rapid succession, often across multiple threads. Attackers with FTP credentials or a web shell chain these internal API requests to bypass CloudLinux CageFS isolation and escalate privileges to root. The patch was released on June 1, 2026, in cPanel plugin version 2.4.8, bundled with WHM plugin 5.3.2.1. Administrators are urged to update immediately or remove the user-end plugin as a mitigation.
The article provides additional technical details on CVE-2026-54420, noting that the flaw allows a user with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux or CageFS. LiteSpeed has shared detection commands and indicators of compromise, including a grep command to check for exploitation attempts and signs such as chained generateEcCert and packageUserSize calls. Namecheap is credited with reporting the issue on May 31, 2026, and the fix is included in LiteSpeed WHM Plugin v5.3.2.1 or higher.
The new article adds that CISA's KEV inclusion of CVE-2026-54420 is accompanied by the agency's newly issued Binding Operational Directive 26-04, which mandates federal agencies to patch within three days. LiteSpeed has confirmed active exploitation and provided a grep command for server administrators to check for compromise, while also noting that the flaw is a UNIX symlink following weakness in the cPanel user-end plugin affecting versions before 2.4.8.
The SecurityWeek report adds that the LiteSpeed symlink flaw (CVE-2026-54420) has been exploited in the wild since May, and that the Joomla Content Editor bug (CVE-2026-48907) has public exploit code and automated attacks targeting sites even without public registration. Joomla warned that updating closes the entry point but does not clean already compromised sites, and provided indicators of compromise for administrators. CISA has added both vulnerabilities to its KEV catalog, requiring federal agencies to patch by June 18 and June 19 respectively.
A dedicated technical report now reveals that CVE-2026-54420 is a UNIX symbolic link following flaw (CWE-61) in the LiteSpeed cPanel plugin that specifically threatens shared hosting environments running CloudLinux with CageFS isolation. Attackers with only FTP credentials or a web shell can craft malicious symlinks to escape CageFS and access sensitive files across other accounts, potentially leading to privilege escalation or data exposure. CISA added the vulnerability to the KEV catalog on June 15, 2026, with a remediation deadline of June 18 under BOD 26-04, emphasizing that active exploitation is already underway.