Security Report · recordedfuture.com

Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively Exploited

Jul 10, 2026 · Original article ↗

Summary

Recorded Future identified 59 high-impact vulnerabilities in June 2026; 23 were in CISA’s KEV catalog, and 56 were reported as actively exploited. The report also highlights malware-linked campaigns, widespread RCE exposure, and public PoCs.

Key points

Insikt Group identified 59 high-impact vulnerabilities across 36 vendors; 30 received a Very Critical Recorded Future Risk Score, a 47% increase from May.
The report says 23 vulnerabilities were listed in CISA’s KEV catalog, 33 were reported by vendors, and three were primarily surfaced through honeypot data.
Fifty-six vulnerabilities were reported as actively exploited in June; the table excludes three CVEs associated with honeypot activity.
Twenty-five vulnerabilities enabled remote code execution, and public proof-of-concept exploits were identified for 53 of the 59 vulnerabilities.
Campaign activity included exploitation linked to SharkLoader and Cobalt Strike, Lazarus Group’s COPPERHEDGE, APT36 operations, a C0XMO botnet, and Qilin ransomware.
Four vulnerabilities in the prominent disclosures table were at least five years old, and the fastest observed disclosure-to-exploitation interval was under one day.

Article Details

Publisher: Recorded Future
Report Period: June 2026
Scope: High-impact vulnerabilities and related exploitation activity identified in June 2026, including actively exploited CVEs, malware-linked activity, and proof-of-concept exploits.
Sample Size: 59 high-impact vulnerabilities; the actively exploited vulnerability table lists 56, excluding three CVEs associated with honeypot activity.
Key Statistics: 30 of 59 vulnerabilities had a Very Critical Recorded Future Risk Score.
23 of 59 vulnerabilities were included in CISA's Known Exploited Vulnerabilities catalog; 33 were reported by vendors and three were primarily surfaced through honeypot data.
The 59 vulnerabilities affected products from 36 vendors; Microsoft accounted for approximately 17%.
25 of 59 vulnerabilities enabled remote code execution, affecting products from 18 vendors.
Public proof-of-concept exploits were identified for 53 of 59 vulnerabilities.
Recommendations: Prioritize vulnerabilities based on likelihood of exploitation as well as severity.
Verify the validity and efficacy of public proof-of-concept exploits before testing them.
Identify and prioritize internet-facing assets vulnerable to specific CVEs.
Assess vulnerabilities in vendors' and suppliers' internet-facing systems.

CVE

CVE-2016-4437CVE-2016-4437 CVE-2020-17103CVE-2020-17103 CVE-2021-26855CVE-2021-26855 CVE-2021-27076CVE-2021-27076 CVE-2021-27137CVE-2021-27137 CVE-2021-36260CVE-2021-36260 CVE-2022-0492CVE-2022-0492 CVE-2022-27925CVE-2022-27925 CVE-2022-40684CVE-2022-40684 CVE-2022-41082CVE-2022-41082 CVE-2023-20198CVE-2023-20198 CVE-2023-32315CVE-2023-32315 CVE-2023-46747CVE-2023-46747 CVE-2024-21182CVE-2024-21182 CVE-2024-21762CVE-2024-21762 CVE-2024-36401CVE-2024-36401 CVE-2025-48595CVE-2025-48595 CVE-2025-55182CVE-2025-55182 CVE-2025-6218CVE-2025-6218 CVE-2025-67038CVE-2025-67038 CVE-2025-8088CVE-2025-8088 CVE-2026-10520CVE-2026-10520 CVE-2026-11645CVE-2026-11645 CVE-2026-12569CVE-2026-12569 CVE-2026-20230CVE-2026-20230 CVE-2026-20245CVE-2026-20245 CVE-2026-20253CVE-2026-20253 CVE-2026-20262CVE-2026-20262 CVE-2026-21509CVE-2026-21509 CVE-2026-21513CVE-2026-21513 CVE-2026-25089CVE-2026-25089 CVE-2026-25939Insikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.CVE-2026-28318CVE-2026-28318 CVE-2026-3300CVE-2026-3300 CVE-2026-33825CVE-2026-33825 CVE-2026-34908CVE-2026-34908 CVE-2026-34909CVE-2026-34909 CVE-2026-34910CVE-2026-34910 CVE-2026-35273CVE-2026-35273 CVE-2026-35616Insikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.CVE-2026-39808CVE-2026-39808 CVE-2026-39813CVE-2026-39813 CVE-2026-4020CVE-2026-4020 CVE-2026-41089CVE-2026-41089 CVE-2026-41091CVE-2026-41091 CVE-2026-42271CVE-2026-42271 CVE-2026-44963CVE-2026-44963 CVE-2026-45247CVE-2026-45247 CVE-2026-46817CVE-2026-46817 CVE-2026-48558CVE-2026-48558 CVE-2026-48907CVE-2026-48907 CVE-2026-5027CVE-2026-5027 CVE-2026-50751CVE-2026-50751 CVE-2026-54420CVE-2026-54420 CVE-2026-7473CVE-2026-7473 CVE-2026-8206CVE-2026-8206

Threat Actors

APT36Reportedly exploited Microsoft vulnerabilities in operations targeting India; the activity was linked to backdoor deployment and SHEETCREEP.C0XMOIdentified as a botnet propagating through DD-WRT routers.LazarusReportedly exploited CVE-2025-55182 to deploy COPPERHEDGE against financial and blockchain-related organizations.Lazarus GroupThe report identifies Lazarus Group as exploiting CVE-2025-55182 to deploy COPPERHEDGE against financial and blockchain-related organizations.Qilin RansomwareReportedly associated with exploitation of a vulnerability affecting Check Point gateways.StrikeSharkNamed in the report as exploiting public-facing applications and vulnerabilities to deploy SharkLoader, which delivered Cobalt Strike.

Malware

Cobalt StrikeIn June 2026, StrikeShark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in COPPERHEDGEto deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated EKZMicrosoft vulnerabilities in operations targeting India; a C0XMO botnet propagated through DD-WRT routers; EKZ information-stealing malware was delivered through FortiClient EMS exploitation; and Qilin ransomware was Qilin Ransomwarerouters; EKZ information-stealing malware was delivered through FortiClient EMS exploitation; and Qilin ransomware was associated with a vulnerability affecting Check Point gateways.SharkLoaderIn June 2026, StrikeShark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in SHEETCREEPThis activity was linked to backdoor deployment and SHEETCREEP.

Vendors

ApacheApache Shiro AristaArista EOS BerriAIBerriAI LiteLLM Check PointCheck Point Security Gateway, Quantum Security Gateway, and Spark Firewalls CiscoCisco Unified Communications Manager F5F5 BIG-IP FortinetInsikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.FrangoteamInsikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.GeoServerGeoserver GoogleGoogle Chromium V8 and Chrome HikvisionHikvision Firmware IvantiIvanti Sentry LantronixLantronix EDS5000 LiteSpeedLiteSpeed cPanel Plugin MetaMeta React Server Components packages MicrosoftThe 59 vulnerabilities in this report affected products from 36 vendors, with Microsoft accounting for approximately 17% of the vulnerabilities.MirasvitMirasvit Full Page Cache Warmer for Magento 2 OracleOracle PeopleSoft Enterprise PeopleTools PTCPTC Windchill, Windchill PDMLink, and FlexPLM SimpleHelpSimpleHelp SolarWindsSolarWinds Serv-U SplunkSplunk Enterprise UbiquitiUbiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro VeeamVeeam Backup and Replication WPEverestWPEverest Everest Forms Pro ZimbraZimbra

Products

Android FrameworkAndroid Framework Apache ShiroApache Shiro Backup and ReplicationVeeam Backup and Replication BIG-IPF5 BIG-IP Business Productivity ServersMicrosoft SharePoint and Business Productivity Servers Catalyst SD-WAN ControllerCatalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager and Controller Chromium V8Google Chromium V8 and Chrome cPanel PluginLiteSpeed cPanel Plugin DD-WRTDD-WRT Firmware Defender Antimalware PlatformMicrosoft Defender Antimalware Platform EDS5000Lantronix EDS5000 EOSArista EOS Everest Forms ProWPEverest Everest Forms Pro Exchange ServerMicrosoft Exchange Server 2016 and 2019 Express 7Ubiquiti UniFi OS, UniFi OS Server, Express 7, and UDM FlexPLMPTC Windchill, Windchill PDMLink, and FlexPLM FortiClient EMSInsikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.FortiOSFortinet FortiOS, FortiProxy, and FortiSwitchManager FortiProxyFortinet FortiOS, FortiProxy, and FortiSwitchManager FortiSandboxFortiSandbox PaaS FortiSandbox PaaSFortiSandbox PaaS FortiSwitchManagerFortinet FortiOS, FortiProxy, and FortiSwitchManager Full Page Cache Warmer for Magento 2Mirasvit Full Page Cache Warmer for Magento 2 FUXAInsikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.Google ChromeGoogle Chromium V8 and Chrome Gravity SMTPGravity SMTP IOS XE SoftwareCisco IOS XE Software Joomla Content Editor (JCE)Joomla Content Editor (JCE) extension for Joomla Kirki – Freeform Page Builder, Website Builder & CustomizerKirki – Freeform Page Builder, Website Builder & Customizer LangflowLangflow LiteLLMBerriAI LiteLLM Malware Protection EngineMicrosoft Malware Protection Engine Microsoft 365 Apps for EnterpriseMicrosoft 365 Apps for Enterprise and Office 2016 Microsoft SharePointMicrosoft SharePoint and Business Productivity Servers Microsoft WindowsMicrosoft Windows 10/11 and Windows Server 2019 Office 2016Microsoft 365 Apps for Enterprise and Office 2016 OpenfireOpenfire Oracle PaymentsOracle Payments PeopleSoft Enterprise PeopleToolsOracle PeopleSoft Enterprise PeopleTools Quantum Security GatewayCheck Point Security Gateway, Quantum Security Gateway, and Spark Firewalls React Server ComponentsMeta React Server Components packages Security GatewayCheck Point Security Gateway, Quantum Security Gateway, and Spark Firewalls SentryIvanti Sentry Serv-USolarWinds Serv-U Spark FirewallsCheck Point Security Gateway, Quantum Security Gateway, and Spark Firewalls Splunk EnterpriseSplunk Enterprise UDMUbiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro UDM-ProUbiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro UniFi OSUbiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro UniFi OS ServerUbiquiti UniFi OS, UniFi OS Server, UDM, and UDM-Pro Unified Communications ManagerCisco Unified Communications Manager WebLogic ServerOracle WebLogic Server WindchillPTC Windchill, Windchill PDMLink, and FlexPLM Windchill PDMLinkPTC Windchill, Windchill PDMLink, and FlexPLM Windows ServerMicrosoft Windows 10/11 and Windows Server 2019 WinRARWinRAR

Tools

Cobalt StrikeIn June 2026, StrikeShark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in NucleiInsikt Group created Nuclei templates to detect two of the vulnerabilities featured in this month’s report: CVE-2026-35616 affecting Fortinet FortiClient EMS and CVE-2026-25939 affecting Frangoteam FUXA.

Countries

IndiaCVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated through DD-WRT routers; EKZ information-stealing malware was delivered through

Industries

BlockchainStrikeShark set: Lazarus Group exploited CVE-2025-55182 to deploy COPPERHEDGE against financial and blockchain-related organizations.financialthe broader StrikeShark set: Lazarus Group exploited CVE-2025-55182 to deploy COPPERHEDGE against financial and blockchain-related organizations.

Related Articles