June 2026 CVE Landscape

Malware Analysis
1

In June 2026, Insikt Group® identified 60 high-impact vulnerabilities that should be prioritized for remediation, 30 of which had a Very Critical Recorded Future Risk Score. This represents a 49% increase from last month. 23 of the 60 vulnerabilities were included in the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 34 were reported by vendors, and three were primarily surfaced through honeypot data.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

    <p>The 60 vulnerabilities in this report affected products from 36 vendors, with Microsoft accounting for approximately 18% of the vulnerabilities. The remaining exposure was concentrated across a range of enterprise software, security products, network infrastructure, developer tooling, and cloud platform vendors.</p>
    <p>Insikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA. These are available to Recorded Future customers via the Recorded Future Intelligence Operations Platform.</p>
    <h2>Quick reference: June 2026 Vulnerability Table</h2>
    <p><em>All 57 vulnerabilities below were actively exploited in June 2026. This table does not include the three CVEs associated with honeypot activity, which are available to Recorded Future customers via the CVE Monthly report, in the platform. The table below also provides examples of public PoCs identified by Insikt Group. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.</em></p>
    <div>
      <div>
        <div><strong>#</strong></div>
        <div><strong>Vulnerability</strong></div>
        <div><strong>Risk</strong><br /><strong>Score</strong></div>
        <div><strong>Vendor/Product</strong></div>
        <div><strong>KEV</strong></div>
        <div><strong>Malware Analysis</strong></div>
        <div><strong>RCE</strong></div>
        <div><strong>PoC</strong></div>
      </div>
      <div>
        <div>1</div>
        <div>CVE-2020-17103</div>
        <div>99</div>
        <div>Microsoft Windows 10/11 and Windows Server 2019</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2020-17103&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>2</div>
        <div>CVE-2022-0492</div>
        <div>99</div>
        <div>Linux Kernel</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2022-0492&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>3</div>
        <div>CVE-2025-55182</div>
        <div>99</div>
        <div>Meta React Server Components packages</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-55182&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>4</div>
        <div>CVE-2025-67038</div>
        <div>99</div>
        <div>Lantronix EDS5000</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>5</div>
        <div>CVE-2025-8088</div>
        <div>99</div>
        <div>WinRAR</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-8088&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>6</div>
        <div>CVE-2026-10520</div>
        <div>99</div>
        <div>Ivanti Sentry</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-10520&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>7</div>
        <div>CVE-2026-11645</div>
        <div>99</div>
        <div>Google Chromium V8 and Chrome</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-11645&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>8</div>
        <div>CVE-2026-12569</div>
        <div>99</div>
        <div>PTC Windchill, Windchill PDMLink, and FlexPLM</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>9</div>
        <div>CVE-2026-20230</div>
        <div>99</div>
        <div>Cisco Unified Communications Manager</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>10</div>
        <div>CVE-2026-20245</div>
        <div>99</div>
        <div>Cisco Catalyst SD-WAN Manager and Controller</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-20245&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>11</div>
        <div>CVE-2026-20253</div>
        <div>99</div>
        <div>Splunk Enterprise</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>12</div>
        <div>CVE-2026-20262</div>
        <div>99</div>
        <div>Cisco Catalyst SD-WAN Manager</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-20262&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>13</div>
        <div>CVE-2026-21509</div>
        <div>99</div>
        <div>Microsoft 365 Apps for Enterprise and Office 2016</div>
        <div></div>
        <div>
          <p>✓</p>
          <p>(available to Recorded Future Customers)</p>
        </div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-21509&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>14</div>
        <div>CVE-2026-28318</div>
        <div>99</div>
        <div>SolarWinds Serv-U</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-28318&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>15</div>
        <div>CVE-2026-33825</div>
        <div>99</div>
        <div>Microsoft Defender Antimalware Platform</div>
        <div></div>
        <div>
          <p>✓</p>
          <p>(available to Recorded Future Customers)</p>
        </div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-33825&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>16</div>
        <div>CVE-2026-34908</div>
        <div>99</div>
        <div>Ubiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>17</div>
        <div>CVE-2026-34909</div>
        <div>99</div>
        <div>Ubiquiti UniFi OS, UniFi OS Server, Express 7, and UDM</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>18</div>
        <div>CVE-2026-34910</div>
        <div>99</div>
        <div>Ubiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>19</div>
        <div>CVE-2026-35273</div>
        <div>99</div>
        <div>Oracle PeopleSoft Enterprise PeopleTools</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-35273&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>20</div>
        <div>CVE-2026-39808</div>
        <div>99</div>
        <div>FortiSandbox PaaS</div>
        <div></div>
        <div>
          <p>✓</p>
          <p>(available to Recorded Future Customers)</p>
        </div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-39808&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>21</div>
        <div>CVE-2026-41089</div>
        <div>99</div>
        <div>Microsoft Windows Server 2012</div>
        <div></div>
        <div>
          <p>✓</p>
          <p>(available to Recorded Future Customers)</p>
        </div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-41089&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>22</div>
        <div>CVE-2026-42271</div>
        <div>99</div>
        <div>BerriAI LiteLLM</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-42271&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>23</div>
        <div>CVE-2026-48558</div>
        <div>99</div>
        <div>SimpleHelp</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>24</div>
        <div>CVE-2026-48907</div>
        <div>99</div>
        <div>Joomla Content Editor (JCE) extension for Joomla</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-48907&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>25</div>
        <div>CVE-2026-50751</div>
        <div>99</div>
        <div>Check Point Security Gateway, Quantum Security Gateway, and Spark Firewalls</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-50751&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>26</div>
        <div>CVE-2026-54420</div>
        <div>99</div>
        <div>LiteSpeed cPanel Plugin</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-54420&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>27</div>
        <div>CVE-2026-7473</div>
        <div>99</div>
        <div>Arista EOS</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>28</div>
        <div>CVE-2021-26855</div>
        <div>89</div>
        <div>Microsoft Exchange Server 2016 and 2019</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2021-26855&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>29</div>
        <div>CVE-2021-36260</div>
        <div>89</div>
        <div>Hikvision Firmware</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2021-36260&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>30</div>
        <div>CVE-2022-40684</div>
        <div>89</div>
        <div>Fortinet FortiOS, FortiProxy, and FortiSwitchManager</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2022-40684&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>31</div>
        <div>CVE-2023-20198</div>
        <div>89</div>
        <div>Cisco IOS XE Software</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2023-20198&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>32</div>
        <div>CVE-2024-21182</div>
        <div>89</div>
        <div>Oracle WebLogic Server</div>
        <div>✓</div>
        <div></div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2024-21182&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>33</div>
        <div>CVE-2024-21762</div>
        <div>89</div>
        <div>Fortinet FortiProxy and FortiOS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2024-21762&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>34</div>
        <div>CVE-2025-48595</div>
        <div>89</div>
        <div>Android Framework</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-48595&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>35</div>
        <div>CVE-2025-6218</div>
        <div>89</div>
        <div>WinRAR</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2025-6218&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>36</div>
        <div>CVE-2026-21513</div>
        <div>89</div>
        <div>Microsoft Windows 10 and Windows Server 2012</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>37</div>
        <div>CVE-2026-3300</div>
        <div>89</div>
        <div>WPEverest Everest Forms Pro</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/HORKimhab/CVE-2026-3300" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>38</div>
        <div>CVE-2026-35616</div>
        <div>89</div>
        <div>Fortinet FortiClientEMS</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-35616&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>39</div>
        <div>CVE-2026-41091</div>
        <div>89</div>
        <div>Microsoft Malware Protection Engine</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-41091&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>40</div>
        <div>CVE-2026-44963</div>
        <div>89</div>
        <div>Veeam Backup and Replication</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>41</div>
        <div>CVE-2026-45247</div>
        <div>89</div>
        <div>Mirasvit Full Page Cache Warmer for Magento 2</div>
        <div>✓</div>
        <div></div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-45247&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>42</div>
        <div>CVE-2016-4437</div>
        <div>79</div>
        <div>Apache Shiro</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2016-4437&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>43</div>
        <div>CVE-2021-27076</div>
        <div>79</div>
        <div>Microsoft SharePoint and Business Productivity Servers</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div></div>
      </div>
      <div>
        <div>44</div>
        <div>CVE-2021-27137</div>
        <div>79</div>
        <div>DD-WRT Firmware</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>45</div>
        <div>CVE-2022-27925</div>
        <div>79</div>
        <div>Zimbra</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2022-27925&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>46</div>
        <div>CVE-2022-41082</div>
        <div>79</div>
        <div>Microsoft Exchange Server 2013</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2022-41082&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>47</div>
        <div>CVE-2023-32315</div>
        <div>79</div>
        <div>Openfire</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2023-32315&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>48</div>
        <div>CVE-2023-46747</div>
        <div>79</div>
        <div>F5 BIG-IP</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2023-46747&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>49</div>
        <div>CVE-2024-36401</div>
        <div>79</div>
        <div>Geoserver</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2024-36401&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>50</div>
        <div>CVE-2026-25089</div>
        <div>79</div>
        <div>Fortinet FortiSandbox PaaS and Cloud</div>
        <div></div>
        <div>✓</div>
        <div>✓</div>
        <div><a href="https://github.com/search?q=CVE-2026-25089&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>51</div>
        <div>CVE-2026-39813</div>
        <div>79</div>
        <div>Fortinet FortiSandbox and Cloud</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-39813&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>52</div>
        <div>CVE-2026-4020</div>
        <div>79</div>
        <div>Gravity SMTP</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-4020&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>53</div>
        <div>CVE-2026-45586</div>
        <div>79</div>
        <div>Microsoft Windows 10 and Windows Server 2012</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div></div>
      </div>
      <div>
        <div>54</div>
        <div>CVE-2026-46817</div>
        <div>79</div>
        <div>Oracle Payments</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-46817&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>55</div>
        <div>CVE-2026-5027</div>
        <div>79</div>
        <div>Langflow</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-5027&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>56</div>
        <div>CVE-2026-8206</div>
        <div>79</div>
        <div>Kirki – Freeform Page Builder, Website Builder &amp; Customizer</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/search?q=CVE-2026-8206&amp;type=repositories" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
      <div>
        <div>57</div>
        <div>CVE-2026-25939</div>
        <div>72</div>
        <div>Frangoteam FUXA</div>
        <div></div>
        <div>✓</div>
        <div></div>
        <div><a href="https://github.com/mbanyamer/CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary" rel="noreferrer" target="_blank">✓ Link</a></div>
      </div>
    </div>
    <p><em><strong>Table 1:</strong></em> <em>List of vulnerabilities that were actively exploited in June, 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).</em></p>
    <h2>Key trends: June 2026</h2>
    <ul>
      <li>In June 2026, StrikeShark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated through DD-WRT routers; EKZ information-stealing malware was delivered through FortiClient EMS exploitation; and Qilin ransomware was associated with a vulnerability affecting Check Point gateways.</li>
      <li>25 of the 60 vulnerabilities enabled remote code execution (RCE), affecting products from 18 vendors: Meta, WinRAR, Ivanti, Google, PTC, Cisco, Ubiquiti, Fortinet, Microsoft, BerriAI, Android, WPEverest, Veeam, Mirasvit, Apache, Hikvision, F5, and GeoServer.</li>
      <li>Insikt Group identified public proof-of-concept (PoC) exploits for 53 of the 60 vulnerabilities identified this month.</li>
      <li>The most commonly observed flaws this month were CWE-22 (Path Traversal), followed by CWE-502 (Deserialization of Untrusted Data), CWE-78 (OS Command Injection), CWE-306 (Missing Authentication for Critical Function), and CWE-287 (Improper Authentication).</li>
      <li>4 of the 60 vulnerabilities in this month’s prominent vulnerability disclosures table are at least five years old, with the oldest approximately ten years old, reinforcing how attackers continue to exploit long-known weaknesses in environments where patching has lagged. Additionally, the fastest observed time from a vulnerability’s public disclosure to exploitation was less than one day.</li>
    </ul>
    <h2>Trend analysis: Malware-linked exploitation and intrusion activity</h2>
    <p>June's strongest campaign-linked theme was the exploitation of externally reachable enterprise applications and appliances. Insikt Group published a TTP Instance on the StrikeShark campaign which described activity spanning CVE-2025-55182 affecting React Server Components, CVE-2021-26855 and CVE-2022-41082 affecting Microsoft Exchange, CVE-2021-36260 affecting Hikvision firmware, CVE-2022-40684 and CVE-2024-21762 affecting Fortinet FortiOS, CVE-2023-20198 affecting Cisco IOS XE Web UI, CVE-2016-4437 affecting Apache Shiro, CVE-2021-27076 affecting Microsoft SharePoint, CVE-2022-27925 affecting Zimbra, CVE-2023-32315 affecting Openfire, CVE-2023-46747 affecting F5 BIG-IP, and CVE-2024-36401 affecting GeoServer. The exploitation of these vulnerabilities resulted in the deployment of SharkLoader, which then delivered Cobalt Strike.</p>
    <div>
      <div>
        <div>
          <img alt="Screenshot detailing risk assessment metrics and exploit status for the React2Shell vulnerability." height="1014" src="https://www.recordedfuture.com/media_1019592f9a7666c73f4e8cbcd9b9d132604d812c0.png?width=750&amp;format=png&amp;optimize=medium" width="2048" />
        </div>
      </div>
      <div>
        <div><em><strong>Figure 1:</strong></em> <em><a href="https://www.recordedfuture.com/use-case/vulnerability-prioritization" rel="noreferrer" target="_blank">Vulnerability Intelligence Card®</a></em> <em>for CVE-2025-55128 (React2Shell) in Recorded Future (Source: Recorded Future)</em></div>
      </div>
    </div>
    <p>React Server Components was also linked to targeted malware delivery outside the broader StrikeShark set: Lazarus Group exploited CVE-2025-55182 to deploy COPPERHEDGE against financial and blockchain-related organizations. Microsoft-related exploitation appeared in both endpoint and document-processing contexts: APT36 exploited CVE-2026-21509 (affecting Microsoft 365 Apps for Enterprise and Office 2016) and CVE-2026-21513 (affecting Windows client and server versions) in operations targeting India. This activity was linked to backdoor deployment and SHEETCREEP. CVE-2021-27137, affecting DD-WRT firmware, was linked to a C0XMO botnet campaign across Linux architectures, while Qilin Ransomware was associated with CVE-2026-50751 affecting Checkpoint Security Gateway and Spark Firewalls.</p>
    <p>PoC exploit trends and analyses associated with this month's high-impact vulnerabilities are available to Recorded Future customers.</p>

Article Link: June 2026 CVE Landscape