The federal government's cybersecurity watchdog has issued an unambiguous warning to network administrators and hosting providers alike: two newly cataloged vulnerabilities are not theoretical risks — they are being weaponized in the wild right now. The addition of flaws affecting Cisco's Catalyst SD-WAN Manager and LiteSpeed's cPanel plugin to the official Known Exploited Vulnerabilities (KEV) catalog represents an escalating threat to both government infrastructure and the broader commercial ecosystem.
Two Distinct Attack Surfaces, One Urgent Message
The vulnerabilities in question carry meaningfully different technical profiles, but share a common and dangerous outcome: both can ultimately hand an attacker elevated — potentially root-level — control over affected systems.
Cisco Catalyst SD-WAN Manager: When File Uploads Become a Weapon
The first flaw, tracked with a CVSS score of 6.5, resides in the web interface of Cisco's Catalyst SD-WAN Manager platform. At its core, this is an arbitrary file write vulnerability born from insufficient validation of user-supplied input during file upload operations. A threat actor holding even low-privileged credentials can craft a malicious HTTP request that instructs the application to create or overwrite files at the operating system level — well outside any intended application boundary.
The implications are serious. Writing arbitrary files to a system is a well-established stepping stone toward privilege escalation, persistence, and lateral movement. The authentication requirement provides only a modest barrier; in environments where credential hygiene is poor or phishing activity is prevalent, low-privileged accounts are routinely compromised. Federal agencies have been given until June 29, 2026 to remediate this flaw across their networks.
LiteSpeed cPanel Plugin: Symlink Abuse on Shared Hosting
The second vulnerability, rated significantly higher at a CVSS score of 8.5, affects the LiteSpeed cPanel plugin deployed on shared hosting environments — particularly those running CloudLinux or CageFS. These are configurations designed precisely to isolate tenants from one another, making this vulnerability especially troubling in its context.
The flaw stems from improper handling of user-controlled symbolic links. An attacker with FTP access or an established web shell foothold can exploit this symlink-following behavior to escape their sandboxed environment and escalate privileges all the way to root. On a shared hosting server, that means a single compromised tenant account becomes a launchpad for compromising every other account on the machine — along with the server itself.
"This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions prior to 2.4.8."
The urgency here is compounded by the scope of deployment. LiteSpeed's cPanel plugin is widely used across commercial hosting providers globally, meaning the attack surface is not confined to any single organization or sector. CISA has directed federal agencies to resolve this vulnerability by June 18, 2026 — a notably tighter deadline that reflects the severity and active exploitation status of the flaw.
Detecting Compromise: What to Look For
For administrators managing LiteSpeed-powered hosting environments, detection is actionable. Reviewing server logs for specific API function patterns can reveal whether exploitation has already occurred. Indicators worth investigating include:
generateEcCert and packageUserSize API calls originating from the same user accountAdministrators should treat any matching log output as a potential indicator of compromise requiring deeper forensic review, while acknowledging that false positives are possible. The vulnerability was responsibly disclosed in late May 2026, which means the window between disclosure and active exploitation was remarkably short — a pattern that has become disturbingly routine across the threat landscape.
The KEV Catalog as a Strategic Forcing Function
CISA's Known Exploited Vulnerabilities catalog functions as more than a reference list — under Binding Operational Directive 22-01, it carries legal weight for federal civilian executive branch agencies, mandating remediation within defined timeframes. But the catalog's strategic value extends well beyond the federal perimeter.
Private sector organizations, managed service providers, and critical infrastructure operators would be wise to treat KEV additions as high-priority signals regardless of their regulatory obligations. Threat actors do not distinguish between government and commercial targets when exploitable vulnerabilities exist. The catalog reflects confirmed exploitation, not theoretical risk — and that distinction matters enormously when prioritizing remediation queues.
What You Should Do
- LiteSpeed administrators: Upgrade immediately to LiteSpeed WHM Plugin v5.3.2.1, which includes cPanel plugin v2.4.8 or later. Do not wait for a scheduled maintenance window.
- Cisco SD-WAN operators: Apply available patches for the Catalyst SD-WAN Manager web interface and audit all low-privileged user accounts for signs of abuse or unauthorized access.
- Shared hosting providers: Audit server logs using the recommended detection commands and investigate any suspicious API call patterns, even if output appears benign at first glance.
- Security teams broadly: Review the full KEV catalog regularly and incorporate it into your vulnerability prioritization process — confirmed exploitation in the wild should always accelerate patch timelines.
- Incident response planning: If log review surfaces potential compromise indicators for the LiteSpeed flaw, escalate immediately — root-level access on a shared server warrants a full forensic investigation, not a patch-and-move-on response.
The window between vulnerability disclosure and active exploitation continues to compress. Organizations that treat patch management as a bureaucratic checkbox rather than a time-sensitive security imperative will find themselves perpetually on the wrong side of that timeline.
