vFeed Threat Intelligence Newsletter — June 2026
Welcome to the vFeed June 2026 edition of our Cybersecurity and Vulnerability Newsletter.
Key Highlights During the Month
- CVE Volume Hits 7,319: June 2026 recorded 7,319 new CVEs — up roughly 8% from May’s ~6,780, extending the year’s consistent above-trend disclosure cadence. At ~244 CVEs per day, the attack surface continues to expand. Year-to-date, vFeed has correlated 112,124 vulnerabilities, tracking ~19% ahead of the same period in 2025 (~94,200).
- Critical Volume at 826: Critical vulnerabilities (CVSS 9.0+) reached 826 in June — a noticeable uptick tied largely to Oracle’s July preview CPU-adjacent June advisory and a heavy Adobe/Traefik/Kestra cycle. The month recorded 56 perfect 10.0 CVSS scores, spanning Oracle Fusion Middleware (WebLogic, Coherence, WebCenter), Adobe ColdFusion/Campaign Classic, Ivanti Sentry, Traefik mTLS bypasses, and multiple Node.js sandbox escapes.
- Oracle Critical Patch Update Dominates: Oracle’s June CPU delivered a cluster of CVSS 10.0 unauthenticated RCEs — CVE-2026-35292 / CVE-2026-35301 (WebLogic Server Console), CVE-2026-35307 / CVE-2026-35308 (Coherence), CVE-2026-46778 / CVE-2026-46781 (WebCenter Enterprise Capture), CVE-2026-46798 / CVE-2026-46800 (WebCenter Sites), and CVE-2026-46978 (Solaris RAD) — all scope-changed and network-reachable.
- Ivanti Sentry Under Active Threat: CVE-2026-10520 (unauth OS command injection, CVSS 10.0) and its sibling CVE-2026-10523 (auth-bypass, CVSS 9.8) both carry EPSS scores at the top of the distribution (0.99041 and 0.4719, 99.9th and 98.7th percentiles) — a repeat of the 2023 Ivanti Sentry exploitation pattern that CISA added to KEV within days.
- Sandbox-Escape and CI/CD Supply-Chain Blowout: Four separate vm2 sandbox escapes (CVE-2026-47131/47137/47140/47208), a Traefik trio (CVE-2026-48020/48491/53622) bypassing mTLS and path-based auth, and two CloudPirates Helm GitHub Actions credential-exposure CVEs (CVE-2026-45131/45132) highlight persistent weaknesses in developer tooling and CI pipelines.
Vulnerability Trends in June
| Metric | Mar ’26 | Apr ’26 | May ’26 | June ’26 | MoM |
|---|---|---|---|---|---|
| New CVEs | 6,412 | 6,905 | 6,780 | 7,319 | ▲ 7.9% |
| Modified CVEs | 4,120 | 4,455 | 4,610 | 5,022 | ▲ 8.9% |
| Critical (CVSS 9.0+) | 645 | 712 | 738 | 826 | ▲ 11.9% |
| Perfect 10.0 scores | 34 | 41 | 43 | 56 | ▲ 30.2% |
| CVSS4 scores recorded | 512 | 588 | 640 | 731 | ▲ 14.2% |
| EPSS > 50th percentile | 1,880 | 2,015 | 2,090 | 2,248 | ▲ 7.6% |
Three signals dominate this month’s trend picture. First, critical volume is outpacing overall CVE growth (11.9% vs 7.9% MoM), driven by Oracle CPU releases and a surge in unauth-RCE disclosures on developer/CI infrastructure. Second, perfect-10 counts jumped 30% — nearly all attributable to scope-changed Oracle Fusion Middleware bugs and identity/auth bypasses (SimpleHelp OIDC, Kestra REST filter, MISP OTP bypass, Azure AD). Third, CVSS4-scored CVEs continue their steady climb (+14.2%), reflecting the broader vendor migration to CVSS v4 for high-severity issues — a signal defenders should build into their prioritization pipelines now.
Vulnerability Landscape
vFeed’s threat intelligence dataset now tracks over 262,400 known exploits reported from sources including GitHub, Metasploit, ExploitDB, and PacketStorm. In June, 2,248 unique CVEs out of 7,319 (~30.7%) were published with one or more exploit proof-of-concepts available.
The top exploit sources for June:
| Exploit Source | Unique CVEs Covered |
|---|---|
| ExploitDB | 187 |
| GitHub PoC | 1,942 |
| Metasploit | 41 |
| Talos | 22 |
| Saint | 14 |
GitHub PoCs continue to be the dominant public exploit vector, accounting for roughly 86% of publicly available proof-of-concepts this month. Metasploit modules trailed but focused on the higher-impact end of the distribution — Ivanti Sentry, SimpleHelp OIDC bypass, and Traefik mTLS were all weaponized within 10 days of publication. Talos coverage this month concentrated on the GeoVision GV-I/O Box 4E stack overflows and DVRSearch UDP service (CVE-2026-12485/12846/12847/12848 and CVE-2026-12486/12849/12850/12851).
Platform Impacts
Microsoft — 143 CVEs
| Severity | Count |
|---|---|
| Critical | 21 |
| High | 78 |
| Medium | 40 |
| Low | 4 |
June 2026’s Patch Tuesday (June 10) shipped fixes for 143 CVEs across Windows, Office, SharePoint, Azure, Defender, and M365 Copilot. No zero-days were confirmed exploited in the wild at release, but two carry above-average EPSS trajectories.
- CVE-2026-45480 — Azure Active Directory improper authentication (CVSS 10.0). Network-based privilege elevation; cloud-tenant impact.
- CVE-2026-47291 — Windows HTTP.sys integer overflow → unauth network RCE (CVSS 9.8, EPSS 0.215).
- CVE-2026-44815 — Windows DHCP Client stack-based buffer overflow, unauth network RCE (CVSS 9.8).
- CVE-2026-45657 — Windows Kernel use-after-free, network RCE (CVSS 9.8, EPSS 0.155).
- CVE-2026-45454 / CVE-2026-45484 — SharePoint path traversal / deserialization (CVSS 8.8 both) — SharePoint remains an initial-access favorite; patch quickly.
- CVE-2026-42824 — M365 Copilot missing auth for critical function (CVSS 7.5); early information-disclosure risk in AI-integrated workflows.
- CVE-2026-50656 — “RoguePlanet” Defender Malware Protection Engine EoP, publicly named, still awaiting update at month-end.
Linux Kernel
vFeed tracked 312 Linux kernel CVEs in June. Three named vulnerabilities stood out this month:
| Name | CVE | Subsystem | Type | Key Risk |
|---|---|---|---|---|
| StripeSlip | CVE-2026-48020 (Traefik proxy path) | Reverse-proxy adjacent kernel netfilter interactions | Path-normalization bypass | Auth bypass to protected routes |
| DHCPBurst | CVE-2026-6893 | initramfs/dracut DHCP path | Command injection via crafted DHCPv4 options | Root code exec at boot on adjacent networks |
| SambaWINS-NULL | CVE-2026-3238 | Samba WINS/AD DC | NULL pointer dereference | Unauth remote DoS of AD services |
Kernel disclosures this month skewed heavily toward networking-adjacent components (netfilter, HTTP/2, HTTP/3/QUIC) rather than core memory-management issues. Distributions with legacy dracut DHCP paths (RHEL 8, older SUSE) should treat CVE-2026-6893 as adjacent-network critical — the exploitation requirement is a rogue DHCP responder, which is trivial in shared L2 environments.
WordPress — Authentication Bypass Dominates
184 CVEs in June, with 112 carrying known exploits — an exploit-to-disclosure ratio of 60.9%. Critical highlights:
- CVE-2026-10580 (Hippoo Mobile App for WooCommerce ≤ 1.9.4) — auth-bypass → administrator takeover via REST route re-registration flaw. CVSS 9.8.
- CVE-2026-10795 (UpdraftPlus Backup ≤ 1.26.4) — signature-bypass + zero-key derivation → unauth RCE via forged RPC. CVSS 8.1, EPSS 0.036.
- CVE-2026-8206 (Kirki Builder 6.0.0–6.0.6) — password-reset email hijack → admin takeover. CVSS 9.8.
- CVE-2026-8713 (Avada / Fusion Builder ≤ 3.15.3) — unauth arbitrary file deletion via privacy-cleanup hook → RCE by deleting wp-config.php. CVSS 9.1.
- CVE-2026-49777 (Product Slider Pro for WooCommerce < 3.5.4) — malicious software implant via specified-quantity validation. CVSS 10.0.
- CVE-2026-52704 (WooCommerce PDF Invoice Builder ≤ 2.0.8) — code injection / remote code inclusion. CVSS 10.0.
- CVE-2026-25470 (ACPT Pro Custom Post Types ≤ 2.0.47) — code inclusion, CVSS 10.0.
- CVE-2026-40772 (GeekyBot ≤ 1.2.2) & CVE-2026-48836 (Easy Invoice ≤ 2.1.19) — unauth arbitrary file upload / RCE, CVSS 10.0 each.
Cloud Vulnerabilities and Attack Chains
vFeed tracked 97 cloud-specific CVEs in June across Azure, AWS, GCP, Kubernetes, and container technologies. Notable disclosures:
- CVE-2026-45480 — Azure AD improper authentication → network EoP (CVSS 10.0).
- CVE-2026-40965 — Cloud Foundry UAA v76.12.0–v78.12.0 leaks EC private keys via public
/token_keysendpoint (CVSS 10.0). JWT signing keys exposed → forged tokens. - CVE-2026-45131 / CVE-2026-45132 — CloudPirates Helm Charts GitHub Actions workflows leaking Docker Hub creds, PAT, and SSH signing keys to fork PRs (CVSS 10.0 each).
- CVE-2026-48020 / CVE-2026-48491 / CVE-2026-53622 — Traefik path-normalization + wildcard SNI/mTLS bypasses (CVSS 10.0). Any Kubernetes ingress using Traefik with wildcard hosts + mTLS is exposed.
- CVE-2026-46695 — Boxlite < 0.9.0 container escape via unrestricted kernel capabilities (CVSS 10.0).
- CVE-2026-49869 / CVE-2026-53576 — Kestra
/configssuffix-match auth-bypass → unauth RCE as root via shell-plugin flows; docker-compose default mounts/var/run/docker.sock→ host takeover. - CVE-2026-10561 — IBM Langflow OSS 1.0.0–1.9.3 improper Python isolation + auth bypass → unauth RCE (CVSS 10.0).
- CVE-2026-49257 — mcp-pinot MCP server bound 0.0.0.0:8080 with no auth (CVSS 10.0). Full read/write of connected Pinot cluster.
The dominant attack-chain pattern in June was “management/orchestration plane exposed without authentication” — Traefik, Kestra, Langflow, mcp-pinot, and n8n MCP-browser (CVE-2026-54309) all shipped or defaulted to configurations where a network-reachable endpoint accepted privileged operations without credentials. Combine with CI credentials leaked via GitHub Actions (Helm CVE pair) and Cloud Foundry EC-key exposure, and the emerging pattern is clear: the perimeter for cloud-native attacks has moved from ingress to internal service meshes and dev/orchestration tooling.
Top Weaknesses
Overall — All June CVEs
| CWE | Weakness | Count | % of Total |
|---|---|---|---|
| CWE-79 | Cross-site Scripting | 812 | 11.1% |
| CWE-89 | SQL Injection | 486 | 6.6% |
| CWE-78 | OS Command Injection | 452 | 6.2% |
| CWE-352 | Cross-Site Request Forgery | 401 | 5.5% |
| CWE-434 | Unrestricted Upload of Dangerous File | 318 | 4.3% |
| CWE-22 | Path Traversal | 297 | 4.1% |
| CWE-287 | Improper Authentication | 264 | 3.6% |
| CWE-416 | Use After Free | 218 | 3.0% |
| CWE-502 | Deserialization of Untrusted Data | 186 | 2.5% |
| CWE-306 | Missing Authentication for Critical Function | 174 | 2.4% |
Critical Only (CVSS 9.0+)
| CWE | Weakness | Critical Count |
|---|---|---|
| CWE-78 | OS Command Injection | 128 |
| CWE-502 | Deserialization of Untrusted Data | 96 |
| CWE-306 | Missing Authentication for Critical Function | 84 |
| CWE-287 | Improper Authentication | 78 |
| CWE-434 | Unrestricted Upload of Dangerous File | 71 |
| CWE-94 | Code Injection | 63 |
| CWE-22 | Path Traversal | 55 |
| CWE-798 | Use of Hard-coded Credentials | 41 |
| CWE-269 | Improper Privilege Management | 37 |
| CWE-918 | Server-Side Request Forgery (SSRF) | 32 |
The Critical-only distribution tells a different story than the overall counts. XSS and CSRF dominate raw volume but rarely produce Critical scores; OS command injection, deserialization, and missing/improper authentication produce the highest-impact CVEs. The prominence of CWE-306 (missing auth for critical function) — 84 Critical entries this month — validates the emerging “unauth control-plane” attack pattern and matches the concrete June disclosures in Kestra, Langflow, mcp-pinot, n8n MCP-browser, Gorse, and SimpleHelp OIDC.
Hardware / IoT / Firmware
vFeed tracked 421 hardware, IoT, and firmware CVEs in June. Standout entries:
- GeoVision GV-I/O Box 4E DVRSearch stack overflows — CVE-2026-12485, CVE-2026-12846, CVE-2026-12847, CVE-2026-12848 (unauth UDP:10001, CVSS 10.0 each), plus the
libNetSetObj.socommand injection cluster CVE-2026-12486/12849/12850/12851 (CVSS 9.1). Reachable over LAN and adjacent networks; no auth required. - Aqara IAM/SSO gateway (gw-builder.aqara.com) — CVE-2026-50086 (CVSS 10.0). Unauthenticated bidirectional AES oracle against platform signing key. Cloud-side smart-home identity infrastructure exposure.
- Ivanti Sentry — CVE-2026-10520 (unauth OS command injection, CVSS 10.0, EPSS 0.99041) and CVE-2026-10523 (auth bypass, CVSS 9.8, EPSS 0.4719).
- GL.iNet GL-MT3000 — a large cluster (CVE-2026-11448, 11449, 11450, 11451, 11452, 12186, 12187, 11406, 11447) covering authenticated command injections in FTP config,
/rpc,SET_USER_PWD, minidlna, tor proxy, and OpenVPN import. Fixed in 4.7 / 4.8.1 / 4.9.0-beta3. - InHand Networks IR912/IR915 — CVE-2026-38714/38715/38716/38717 (CVSS 9.8) unauth command injection across Python config, log viewing, file upload, and export functions.
- Tenda / D-Link / Edimax / Wavlink — Persistent embedded-router stack overflows and command injections dominate the small-office-router bucket; nearly all publicly disclosed with PoCs on GitHub.
- RadiX AX6600 — CVE-2026-53876 authenticated root command injection via web console (CVSS 7.2).
- Poly Voice Linux platform — CVE-2026-0826 ICE-enabled buffer overflow → RCE.
The IoT signal remains familiar: default-listening UDP services and lack of shell-parameter escaping in vendor management CGIs are still the primary root causes. What changed this month is scale — the GeoVision and GL.iNet clusters alone account for nearly 20 individual CVEs, meaning inventory-wide detection (not one-off patching) is the pragmatic response.
Critical Exploitable Vulnerabilities — June 2026
Pay attention to these critical vulnerabilities with known exploits and high EPSS scores.
| CVE | Target | CVSS | EPSS %ile | Exploit | CWE |
|---|---|---|---|---|---|
| CVE-2026-10520 | Ivanti Sentry (unauth) | 10.0 | 99.9 | GitHub PoC, Metasploit | CWE-78 |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 99.8 | GitHub PoC | CWE-306 |
| CVE-2026-20253 | Splunk Enterprise 10.x Postgres sidecar | 9.8 | 99.7 | GitHub PoC | CWE-306 |
| CVE-2026-48907 | Joomla JCE editor extension | 9.8 | 99.6 | GitHub PoC, ExploitDB | CWE-434 |
| CVE-2026-50751 | Check Point IKEv1 Remote Access VPN | 9.3 | 99.3 | GitHub PoC | CWE-287 |
| CVE-2026-49160 | HTTP/2 uncontrolled resource consumption | 7.5 | 98.7 | GitHub PoC | CWE-400 |
| CVE-2026-10523 | Ivanti Sentry auth bypass | 9.8 | 98.7 | GitHub PoC | CWE-288 |
| CVE-2026-20230 | Cisco Unified CM SSRF → root | 8.6 | 98.5 | GitHub PoC | CWE-918 |
| CVE-2026-8037 | Progress ADC (LoadMaster) API RCE | 9.6 | 98.0 | GitHub PoC | CWE-78 |
| CVE-2026-25089 | Fortinet FortiSandbox unauth OS cmd inject | 9.8 | 97.5 | GitHub PoC | CWE-78 |
| CVE-2026-47291 | Windows HTTP.sys integer overflow RCE | 9.8 | 97.3 | GitHub PoC | CWE-190 |
| CVE-2026-48558 | SimpleHelp OIDC signature bypass | 10.0 | 63.3 | GitHub PoC | CWE-347 |
| CVE-2026-47928 | Adobe ColdFusion improper input validation | 10.0 | 94.6 | GitHub PoC | CWE-20 |
Actionable Recommendations
1. Patch Ivanti Sentry and Oracle Fusion Middleware immediately. CVE-2026-10520 sits at EPSS 0.99041 (99.9th percentile) — historically, entries above 0.95 EPSS reach CISA KEV within 7–14 days. Upgrade Sentry to R10.5.2 / R10.6.2 / R10.7.1 and apply Oracle’s June CPU covering CVE-2026-35292, 35301, 35307, 35308, 46778, 46781, 46798, 46800, 46803, 46846, and 46978.
2. Audit every unauthenticated management endpoint on your internal network. The dominant June pattern — Kestra /configs, Langflow, mcp-pinot 0.0.0.0:8080, n8n MCP-browser HTTP mode, Gorse /api/dump, SimpleHelp OIDC — is “listens by default, trusts by default.” Run outbound-blocked network scans against 8080/8443/4200-family ports on all clusters, and enforce authentication headers at the ingress layer regardless of what the application claims.
3. Rotate all Cloud Foundry UAA EC keys and Helm/CI credentials. CVE-2026-40965 exposed EC private keys through UAA’s public /token_keys endpoint on any deployment using EC-signed JWTs. Rotate JWT signing keys immediately, upgrade to uaa_release v78.13.0+, and audit for token forgery. Separately, for any repository derived from CloudPirates Helm Charts (CVE-2026-45131/45132), rotate Docker Hub creds, PAT tokens, and SSH signing keys.
4. Enforce Patch Tuesday within 7 days for Windows HTTP.sys and DHCP Client. CVE-2026-47291 (HTTP.sys integer overflow) and CVE-2026-44815 (DHCP stack overflow) are both unauthenticated network RCEs, both CVSS 9.8. Historical HTTP.sys bugs (CVE-2021-31166, CVE-2022-21907) reached weaponization within weeks. Prioritize DMZ-facing and DHCP-relay hosts.
5. Ban vm2 in production and audit for MCP/AI-tool exposure. Four CVE-2026-47131/47137/47140/47208
Click here to schedule your demo with vFeed Threat Intel today!