Monthly exploitation report · June 2026
Monthly analysis of new exploited vulnerabilities added to KEVIntel and exploitation attempts observed by sensors.
794 were outside CISA KEV when added
Share of events tied to five CVEs
Across 294 CVEs added by KEV Intelligence first
Executive brief
Five CVEs produced 72.1% of June events. Prioritize asset discovery and remediation around Sentry, ThinkPHP Framework, Splunk Enterprise, PeopleSoft Enterprise PeopleTools, and Cisco Unified Communications Manager.
KEV Intelligence added 794 exploited CVEs outside CISA KEV during June; 537 were still absent at month-end.
Event volume and source breadth help identify pressure, but observations do not prove that a real-world target was compromised or represent all exploitation activity worldwide.
Exploitation activity
KEV Intelligence sensors recorded 6,046 exploitation events in June. A small set of vulnerabilities drove most of the observed volume.
Observed exploitation events
May versus June 2026
64
CVEs observed
812
Source IPs
65
First observed
For CISOs, this concentration supports a focused exposure-validation and remediation sprint rather than treating every observed CVE as equally urgent.
Visibility before CISA KEV
294 vulnerabilities were added by KEV Intelligence before later inclusion in CISA KEV. The median lead time was 1.1 days; the longest was 6430.7 days.
1.1 days
Median positive lead
537
Still absent at month-end
Most targeted
Ranked by sensor-observed exploitation events. Event volume shows intensity; unique source IPs help indicate breadth.
38.9% of monthly events
10.5% of monthly events
9.9% of monthly events
8.4% of monthly events
4.4% of monthly events
Meta · react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel
In CISA KEV
3.2% of monthly events
2.8% of monthly events
1.8% of monthly events
1.8% of monthly events
1.5% of monthly events
Vendor exposure
Microsoft
33 outside CISA KEV when added
Cisco
25 outside CISA KEV when added
D-Link
16 outside CISA KEV when added
15 outside CISA KEV when added
Fortinet
14 outside CISA KEV when added
Weakness patterns
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Most common newly added weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
79 newly added KEVs
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
77 newly added KEVs
CWE-434 · Unrestricted Upload of File with Dangerous Type
38 newly added KEVs
CWE-287 · Improper Authentication
37 newly added KEVs
51.7%
Critical severity
625
Public PoC references
562
Nuclei references
64
Observed request paths
Methodology and limitations
These notes define the reporting window, what sensor observations mean, and where the dataset should not be generalized.
Full KEV Intelligence methodologyReporting period is 2026-06-01 00:00:00 UTC through 2026-06-30 23:59:59 UTC.
KEVIntel sensor telemetry represents activity observed by the KEVIntel sensor network. It does not represent all exploitation activity occurring globally.
An observed exploitation attempt does not by itself demonstrate that a real-world target was successfully compromised.
CISA KEV status at month-end is reconstructed from stored CISA addition dates (additive only; removals are not tracked).
Historical or backfilled KEV records cannot be identified reliably from existing fields and are not listed as a separate category.
Prefer deep links to individual CVE reports and this methodology when citing sensor-observed vulnerabilities.
Early warning alerts
Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.
