June 2026 CVE Landscape

What Happened

In June 2026, security researchers identified 60 serious software vulnerabilities that organizations should fix urgently, a nearly 50% increase from the previous month. Hackers are actively exploiting many of these flaws in widely used products from Microsoft, Cisco, Fortinet, Google, and others. Multiple criminal and nation-state groups are using these vulnerabilities to break into organizations: one group called StrikeShark chained together over a dozen separate vulnerabilities to gain deep access, while North Korea's Lazarus Group exploited a critical flaw in popular web development software to install spyware. Organizations using any of the affected products should prioritize patching, especially for vulnerabilities listed in the government's Known Exploited Vulnerabilities catalog. Security teams should also verify that internet-facing systems are updated, as attackers are primarily targeting externally reachable applications and devices.

Key Takeaways

• 60 high-impact vulnerabilities identified in June 2026, a 49% increase from May; 30 scored Very Critical on the Recorded Future Risk Score
• 23 of 60 vulnerabilities are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active in-the-wild exploitation
• StrikeShark campaign chained 13 CVEs across multiple vendors (Microsoft, Fortinet, Cisco, Hikvision, F5, Zimbra, GeoServer, Apache) to deploy SharkLoader and deliver Cobalt Strike
• Lazarus Group exploited CVE-2025-55182 (React2Shell, CVSS 10.0) to deploy COPPERHEDGE and EtherRAT against financial and blockchain organizations via dependency confusion and compromised PoC code
• 25 of 60 vulnerabilities enabled remote code execution across 18 vendors; 53 of 60 had public proof-of-concept exploits available
• Nuclei templates created by Insikt Group for CVE-2026-35616 (FortiClient EMS) and CVE-2026-25939 (Frangoteam FUXA), available to Recorded Future customers

Affected Systems

• Microsoft Windows 10/11, Windows Server 2012/2019, Exchange Server 2013/2016/2019, SharePoint, Microsoft 365 Apps, Office 2016, Defender Antimalware Platform, Malware Protection Engine
• Fortinet FortiClient EMS, FortiOS, FortiProxy, FortiSwitchManager, FortiSandbox PaaS/Cloud
• Cisco Unified Communications Manager, Catalyst SD-WAN Manager/Controller, IOS XE Software
• Ubiquiti UniFi OS, UniFi OS Server, UDM, UDM-Pro, Express 7
• Linux Kernel, Android Framework, DD-WRT Firmware
• Google Chromium V8 and Chrome
• Oracle PeopleSoft Enterprise PeopleTools, WebLogic Server, Payments
• Splunk Enterprise, SolarWinds Serv-U, Veeam Backup and Replication
• Check Point Security Gateway, Quantum Security Gateway, Spark Firewalls
• Meta React Server Components / Next.js
• WinRAR, Apache Shiro, Openfire, F5 BIG-IP, GeoServer, Zimbra, Joomla JCE, PTC Windchill, SimpleHelp, BerriAI LiteLLM, Langflow, Arista EOS, Lantronix EDS5000, Hikvision Firmware, LiteSpeed cPanel Plugin, WPEverest Everest Forms Pro, Mirasvit Full Page Cache Warmer, Gravity SMTP, Kirki Page Builder, Frangoteam FUXA

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Threat actors exploit externally reachable enterprise applications and appliances using known CVEs (e.g., FortiOS, Cisco IOS XE, Exchange Server, React Server Components)
2. Execution: Exploited vulnerabilities deploy loaders such as SharkLoader or directly execute backdoor code on compromised hosts
3. Persistence/C2: Loaders deliver second-stage payloads including Cobalt Strike beacons, COPPERHEDGE, EtherRAT, or SHEETCREEP backdoors establishing persistent command-and-control channels
4. Lateral Movement: Attackers use compromised credentials and additional vulnerability exploitation to move laterally across the network via RCE-capable CVEs
5. Exfiltration/Impact: Data exfiltration via established C2 channels; in ransomware cases (Qilin), data is encrypted and exfiltrated for double extortion

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Nuclei templates (Recorded Future Intelligence Operations Platform)

Insikt Group created Nuclei templates for CVE-2026-35616 (Fortinet FortiClient EMS) and CVE-2026-25939 (Frangoteam FUXA), available to Recorded Future customers. No YARA, Sigma, Snort/Suricata, or SIEM queries are provided in the public article.

Detection Engineering Assessment

Required Log Sources

• Vulnerability scanner output with CVE mapping
• Firewall and reverse proxy logs for public-facing applications
• IDS/IPS alerts for known exploit signatures
• EDR telemetry for post-exploitation behavior (process creation, network connections)
• Web server access logs for anomalous requests targeting known CVEs
• Network appliance syslogs (FortiOS, Cisco IOS XE, UniFi OS)
• DNS resolution logs for C2 domain lookups
• Authentication logs for anomalous login patterns post-exploitation

Hunting Hypotheses

Control Gaps

• Network appliances and IoT devices (FortiOS, Cisco IOS XE, DD-WRT, Hikvision, Ubiquiti) typically lack EDR agents, creating blind spots for post-exploitation detection
• Supply chain attacks via dependency confusion (CVE-2025-55182) may bypass traditional perimeter controls and application allowlisting
• Exploitation of legitimate management interfaces on public-facing appliances may not trigger IDS signatures if the exploit blends with normal administrative traffic
• Public PoC availability for 53 of 60 vulnerabilities lowers the barrier for exploitation but also increases noise from scanning activity, potentially masking targeted attacks
• Legacy vulnerabilities (4 of 60 are 5+ years old) may not be covered by current detection rules if they were assumed to be remediated

Key Behavioral Indicators

• Unexpected child processes spawned by web server or application service accounts (e.g., IIS w3wp.exe spawning cmd.exe or powershell.exe)
• Inbound HTTP requests matching known CVE exploit patterns targeting specific endpoints or parameters on public-facing applications
• Anomalous outbound network connections from servers or appliances following inbound exploitation attempts
• Python package installations with names closely resembling legitimate packages (dependency confusion indicators)
• Rapid sequential exploitation attempts against multiple CVEs from a single source, suggesting coordinated campaign activity
• Authentication events on network appliances from unexpected source IPs or without corresponding management session establishment
• Cobalt Strike beacon patterns in network traffic following successful exploitation of public-facing applications

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing network segmentation to isolate network appliances and IoT devices from general corporate networks, limiting lateral movement opportunities post-exploitation.
• Evaluate whether your web application firewall rules cover exploit patterns for the 53 CVEs with public PoC exploits, particularly those targeting CWE-22 (Path Traversal) and CWE-78 (OS Command Injection).
• Consider implementing package integrity verification and allowlisting for Python and npm dependencies to mitigate dependency confusion attacks related to CVE-2025-55182.
• If your organization uses any of the 36 affected vendor products, consider establishing a vulnerability management cadence that prioritizes based on exploitation likelihood (KEV listing, PoC availability) rather than CVSS score alone.
• Consider deploying additional monitoring (syslog forwarding, NetFlow collection) on network appliances that lack EDR coverage to improve detection of post-exploitation activity.

User Protection

• Consider ensuring endpoint protection is updated on all systems running Microsoft Defender Antimalware Platform and Malware Protection Engine, given CVE-2026-33825 and CVE-2026-41091 which target security products themselves.
• If your organization uses Microsoft 365 Apps or Office 2016, consider applying patches for CVE-2026-21509, which APT36 has actively exploited in targeted operations.
• Consider updating WinRAR installations promptly, as two separate WinRAR CVEs (CVE-2025-8088 and CVE-2025-6218) were actively exploited this month with public PoCs available.
• Evaluate whether your email security gateway can detect and block documents exploiting Microsoft Office vulnerabilities (CVE-2026-21509) used by APT36 in targeted phishing operations.

Security Awareness

• Consider incorporating awareness of supply chain attacks (dependency confusion) into developer training programs, particularly for teams using React/Next.js and Python package ecosystems.
• Consider reminding IT and network operations teams about the risk of leaving management interfaces exposed to the internet, given the prevalence of appliance exploitation in this month's CVE landscape.
• Consider rolling into existing awareness programs guidance on verifying the legitimacy of Python and npm packages before installation, given the dependency confusion vector used in CVE-2025-55182 exploitation.
• If applicable to your organization, consider briefing stakeholders on the elevated risk from the 49% month-over-month increase in high-impact vulnerabilities and the need for accelerated patching cycles.

MITRE ATT&CK Mapping