CVE-2026-48907
Known exploited · CISA KEV
EPSS 85% (100th percentile).
CISA federal remediation date Jun 19 · date passed
Vulnerabilities · 128 days ago
Patching is only the first step here. On Joomla, attackers are using an access-control flaw to create trusted editor profiles and plant persistent web shells. On LiteSpeed shared hosting, a symlink bug lets someone who already has FTP or web-shell access cross into root, so one account foothold can become a host-level compromise.
JCE versions before 2.9.99.5 are affected, with extra protections in 2.9.99.6. LiteSpeed’s cPanel plugin is vulnerable in all versions before 2.4.8, and the WHM PlugIn fix is 5.3.2.0. Both flaws are being actively exploited, both are now in CISA’s KEV catalog, and Joomla says public exploit code is already being used in automated attacks.
The bigger risk is post-compromise persistence. A patched Joomla site can still carry a rogue profile or web shell, and a patched shared host can still be owned if the attacker already used the symlink path to reach root.
Known exploited · CISA KEV
EPSS 85% (100th percentile).
CISA federal remediation date Jun 19 · date passed
Known exploited · CISA KEV
CVSS 8.5 HIGH: liteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks… EPSS 1% (73rd percentile).
CISA federal remediation date Jun 18 · date passed
21 sources covering this story
Rilevato sfruttamento di vulnerabilità in prodotto Cisco
Rilevato sfruttamento attivo in rete della CVE-2026-20262 presente in Cisco Catalyst SD-WAN Manager, noto software diffuso in ambienti enterprise per l’amministrazione e gestione centralizzata della rete WAN.
Cisco SD-WAN make-me-root bug under attack
Second Catalyst SD-WAN Manager flaw exploited as an 0-day this month
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks
The flaws allow attackers to execute arbitrary PHP code and gain root privileges on shared hosting servers.
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
CISA added CVE-2026-48907 in Joomla JCE to its KEV catalog after active exploitation; fixes are due by June 19.
Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager
Cisco heeft een kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager. De kwetsbaarheid bevindt zich in de web user interface van Cisco Catalyst SD-WAN Manager en betreft een directory traversal flaw. Deze wordt veroorzaakt door onjuiste inputvalidatie tijdens het uploadproces van bestanden. Een geauthenticeerde aanvaller kan hierdoor willekeurige...
Cisco disclosed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its PSIRT observed being exploited by attackers.
CISA warns of another cPanel plugin flaw exploited in attacks
government agencies three days to secure their servers against an actively exploited vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin.
Cisco patches SD-WAN flaw amid evidence of active exploitation
Cisco’s advisory renews attention on SD-WAN management systems that control how enterprises connect sites to cloud environments and critical applications.
Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw
Cisco patched CVE-2026-20262 in Catalyst SD-WAN Manager after limited exploitation, with federal fixes due June 29.
Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks
Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
CISA added CVE-2026-54420 to KEV, requiring federal agencies to patch LiteSpeed cPanel root escalation by June 18, 2026.
Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ
Part of the PlainSec briefing for 2026-05-14