What landed in CVE-land this week

The week ending 2026-06-22 was bad for anything that treats a filesystem as a trust boundary. Four new entries hit the CISA Known Exploited Vulnerabilities (KEV) catalog between 2026-06-15 and 2026-06-18; the pattern is identical across all four: an attacker writes, overwrites, or dereferences a file they should not touch, and the vendor's authentication or path-handling logic never intervenes. KEV added nothing on 2026-06-22 itself, worth noting only because defenders could spend the day catching up rather than triaging fresh fires.

This is a defender's digest. Each entry below is on KEV, which means CISA has confirmed in-the-wild exploitation and federal civilian agencies are on the clock to patch. If you run any of this software, treat these as active incidents, not theoretical risk.

The KEV four

CVE-2026-20253: Splunk Enterprise PostgreSQL sidecar (added 2026-06-18). The advisory identifies missing authentication on a critical function: an unauthenticated user can reach a PostgreSQL sidecar service endpoint and create or truncate arbitrary files on the Splunk Enterprise host. The primitive is file write, not RCE on its face, but arbitrary file creation and truncation on a Splunk indexer is a short walk to code execution (drop a script into a path the indexer sources, truncate a signed binary to fail-open, or clobber audit logs). Search-head clusters that expose the sidecar port beyond the management VLAN are the highest-priority target.

CVE-2026-48907: Widget Factory Joomla Content Editor (added 2026-06-16). Improper access control lets unauthenticated visitors create new editor profiles, which permits PHP upload and execution. This is a textbook mass-deface and cryptominer-drop bug for hosting fleets; anyone running Joomla plus the Widget Factory Content Editor should assume opportunistic scanning is already underway. Look for newly created editor profiles with unusual usernames and any .php files written to component directories after 2026-06-10.

CVE-2026-54420: LiteSpeed cPanel plugin symlink following (added 2026-06-15). This UNIX symbolic link following flaw becomes serious on shared hosts running CloudLinux and CageFS. A user who already has FTP or web-shell access to one tenant can point a symlink at another tenant's files and use the plugin to read or clobber them, bypassing the per-user jail that CageFS enforces. Shared-hosting operators should treat this as a multi-tenant break, not a single-account bug.

CVE-2026-20262: Cisco Catalyst SD-WAN Manager path traversal (added 2026-06-15). An authenticated remote attacker can traverse the filesystem to create or overwrite an arbitrary file. On an SD-WAN Manager, "arbitrary file" includes template stores, credential material, and the policies that push config to every branch device downstream. Authenticated means low-privilege operator accounts qualify; if you rely on RBAC to contain a compromised NOC credential, this bug removes that containment. The Canadian Centre for Cyber Security has issued AV26-551 (Update 1) reflecting the KEV status.

Everything else the wires carried

The Canadian Centre for Cyber Security published a batch of vendor advisories in the same window that are not yet on KEV but belong in your patch queue: HPE AV26-571 (covering CVE-2026-42945) and AV26-573, an OpenSSL advisory (AV26-572), a Spring advisory (AV26-574), Mozilla (AV26-575), FreeBSD (AV26-576), and AMD (AV26-577). Without a CVSS score or confirmed exploitation signal in the source material, we will not speculate on severity. OpenSSL, Spring, and Mozilla advisories in the same week always merit same-day review by whoever owns your TLS stack, JVM services, and browser fleet.

What to actually do on Monday

The four KEV entries collapse into three defender workflows. First, inventory: do you run this software, and where. Second, exposure: is the vulnerable surface reachable from an untrusted network or untrusted local tenant. Third, detection: what would exploitation look like in the telemetry you already collect.

For the Splunk and Cisco cases, the fastest way to reduce blast radius while you schedule the patch window is a network ACL that constrains the vulnerable endpoint to a jump host. For the Joomla and LiteSpeed cases, patching is the only real answer; the vulnerable code paths are reachable by design.

For a detection starting point, here is a rough SPL sketch for the Splunk sidecar case. It looks for unauthenticated HTTP hits to the sidecar port followed by unexpected file creations under the Splunk install root. Tune ports and paths to your environment before deploying:

index=web sourcetype=access_combined dest_port IN (8089, 8191)
  user="-" status=200
| bin _time span=5m
| stats count values(uri_path) as uris by _time, src_ip, dest_host
| join type=inner dest_host
    [ search index=osquery name=file_events target_path="/opt/splunk/*"
      action IN (created, truncated)
    | stats count as file_ops values(target_path) as paths by host
    | rename host as dest_host ]
| where count > 3 AND file_ops > 0

Two notes on the alert. It will fire on legitimate deployment tooling that hits the management port and writes to /opt/splunk; whitelist your config-management source IPs. It also depends on file-event telemetry from the host rather than from Splunk itself: a bug that lets an attacker truncate files can also let them truncate their own log lines.

The pattern worth naming

Three of the four KEV entries are file-write or file-dereference bugs against products in privileged network positions (an SD-WAN controller, a SIEM, a shared-hosting control plane). The fourth is a CMS component that writes PHP. The lesson is neither novel nor comfortable: filesystem primitives remain the shortest path from "I can talk to this service" to "I own this service." Any security program that still models file write as a Medium-severity finding because it is not RCE is undercounting the risk by a full step of the kill chain.

Patch the four. Hunt for the indicators. When your next threat model encounters a feature that writes user-controlled content to disk under a service account, weight it accordingly.

Verifiable security.