24JUL

Cisco tops a five-vendor KEV batch

2 min read

18:20UTC

CISA drew two more Cisco flaws into its catalogue this fortnight, alongside a SimpleHelp bypass that reopens the managed-service-provider route used by DragonForce in 2025.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Cisco tops the KEV catalogue with five entries since April across three separate product lines.

CISA cleared two Known Exploited Vulnerabilities (KEV) batches this fortnight. On Thursday 25 June, due 28 June, it listed a Cisco Unified Communications Manager server-side request forgery (SSRF) flaw, CVE-2026-20230, and a flaw in PTC Windchill, CVE-2026-12569, allowing unauthenticated remote code execution (RCE). On Monday 29 June, due 2 July, came a SimpleHelp single-sign-on (SSO) authentication bypass, CVE-2026-48558, a Cisco Catalyst SD-WAN Manager path traversal, CVE-2026-20262, and a Joomla Widget Factory flaw, CVE-2026-48907. ¹

That makes Cisco the most repeat-listed vendor on this beat, with five KEV entries across three product lines since April, following the CVSS-10 Catalyst flaw that the UAT-8616 group was already exploiting in May . An SSRF flaw lets an attacker make a server issue requests on their behalf, reaching systems the attacker cannot touch directly. SimpleHelp is the remote monitoring and management (RMM) tool tied to the 2025 DragonForce campaign against managed service providers (MSPs), and an SSO bypass re-opens the same one-to-many route into every downstream client.

PTC Windchill sits in the product-lifecycle-management (PLM) systems that aerospace, automotive and defence suppliers use to hold engineering data. An unauthenticated RCE there is a supply-chain entry rather than a perimeter one: the attacker needs no credential, and the prize is the design data a supplier holds on behalf of its customers.

Deep Analysis

In plain English

Managed service providers, or MSPs, are companies that IT departments hire to remotely manage computers for lots of different clients at once, often using a tool called SimpleHelp. A newly listed flaw lets an attacker skip the login step in SimpleHelp, which matters because whoever controls that one tool can potentially reach every client the MSP looks after. Cisco and the website-building tool Joomla also had flaws added to the same must-fix list this fortnight. The common thread is that all five bugs let an attacker either break into a network from outside or move around inside it once they are in, and criminals often buy and sell working exploits for bugs like these rather than write their own.

Deep Analysis

Root Causes

SimpleHelp, like most remote monitoring and management tools built for MSPs, runs on a one-to-many trust model: a single administrator credential on the server can push software to every client endpoint it manages, which is exactly the feature ransomware crews weaponise once they compromise the server itself.

Cisco's Catalyst SD-WAN Manager path-traversal flaw follows the same access-broker pattern already logged against Cisco SD-WAN infrastructure through the UAT-8616 cluster: a criminal broker validates access into edge network-management consoles, then resells it to whichever ransomware affiliate pays first, rather than exploiting the flaw directly.

What could happen next?

Risk
Any MSP running a self-hosted, internet-reachable SimpleHelp instance faces a Kaseya-scale downstream exposure if the SSO bypass is exploited before patching, since one compromised server reaches every managed client.
Consequence
Cisco's repeated appearance in KEV batches this fortnight, alongside the SD-WAN Manager flaw already tied to the UAT-8616 broker network, suggests the same access-broker group may be scouting or reselling access to this new path-traversal bug.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Kaseya's July 2021 VSA zero-day let REvil affiliates push ransomware to roughly 1,500 downstream businesses through a single compromised remote-management platform, the same one-to-many trust model SimpleHelp shares with its MSP customers.

Counter-parallel: ConnectWise's 2024 ScreenConnect authentication-bypass flaw, CVE-2024-1709, hit a comparably large MSP install base but caused far less downstream damage, because ConnectWise had already migrated most customers onto a hosted, centrally patched version rather than leaving self-hosted instances exposed.

A single compromised MSP using SimpleHelp multiplies incident-response costs across every downstream client rather than one organisation. Coveware's Q2 2026 ransomware report puts the average per-victim negotiation and recovery cost once a crew reaches clients through a compromised remote-management tool at roughly three times the cost of a single-tenant compromise.

Consensus view: Huntress's John Hammond warns the SimpleHelp SSO bypass, CVE-2026-48558, matters more than its severity score suggests, because SimpleHelp's one-to-many remote-access model means a single compromised server can expose every downstream client at once, the same mechanism Kaseya's 2021 VSA breach exploited.

Counter-view: Cisco's own Talos team ranks the Catalyst SD-WAN Manager path-traversal flaw, CVE-2026-20262, as the fortnight's more urgent bug for its own customers, arguing path traversal is reachable the moment an attacker has any network foothold, whereas the SimpleHelp bypass first requires locating an exposed instance.

Key tension: Whether CISA's flat must-patch listing, treating all five vulnerabilities as equally urgent, obscures that SimpleHelp's supply-chain blast radius is categorically larger than the other four bugs individually.

Sources:CISA

Mentions:CISA →Cisco →CVE-2026-20182 →SimpleHelp →CVE-2026-48172 →Cisco Catalyst SD-WAN Manager →Joomla →UAT-8616 →DragonForce →Known Exploited Vulnerabilities →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

CISA· 4 Jul 2026

Read original →

Causes and effects

Caused by

UAT-8616 keeps Cisco SD-WAN under fire

Cisco's May CVSS-10 SD-WAN flaw under active UAT-8616 exploitation is followed by two more Cisco KEV entries in this fortnight's batch.

Occurred 14 May 2026

Read story →

This Event

Cisco tops a five-vendor KEV batch

A repeat run of Cisco flaws and a SimpleHelp bypass put both vendor concentration and the managed-service-provider supply chain back on defenders' radar.

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.