7JUN

Cisco tops a five-vendor KEV batch

2 min read

10:08UTC

CISA drew two more Cisco flaws into its catalogue this fortnight, alongside a SimpleHelp bypass that reopens the managed-service-provider route used by DragonForce in 2025.

← Back to The 2024 patch that is breaking now Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Cisco tops the KEV catalogue with five entries since April across three separate product lines.

CISA cleared two Known Exploited Vulnerabilities (KEV) batches this fortnight. On Thursday 25 June, due 28 June, it listed a Cisco Unified Communications Manager server-side request forgery (SSRF) flaw, CVE-2026-20230, and a flaw in PTC Windchill, CVE-2026-12569, allowing unauthenticated remote code execution (RCE). On Monday 29 June, due 2 July, came a SimpleHelp single-sign-on (SSO) authentication bypass, CVE-2026-48558, a Cisco Catalyst SD-WAN Manager path traversal, CVE-2026-20262, and a Joomla Widget Factory flaw, CVE-2026-48907.⁠¹

That makes Cisco the most repeat-listed vendor on this beat, with five KEV entries across three product lines since April, following the CVSS-10 Catalyst flaw that the UAT-8616 group was already exploiting in May. An SSRF flaw lets an attacker make a server issue requests on their behalf, reaching systems the attacker cannot touch directly. SimpleHelp is the remote monitoring and management (RMM) tool tied to the 2025 DragonForce campaign against managed service providers (MSPs), and an SSO bypass re-opens the same one-to-many route into every downstream client.

PTC Windchill sits in the product-lifecycle-management (PLM) systems that aerospace, automotive and defence suppliers use to hold engineering data. An unauthenticated RCE there is a supply-chain entry rather than a perimeter one: the attacker needs no credential, and the prize is the design data a supplier holds on behalf of its customers.

Deep Analysis

In plain English

Managed service providers, or MSPs, are companies that IT departments hire to remotely manage computers for lots of different clients at once, often using a tool called SimpleHelp. A newly listed flaw lets an attacker skip the login step in SimpleHelp, which matters because whoever controls that one tool can potentially reach every client the MSP looks after. Cisco and the website-building tool Joomla also had flaws added to the same must-fix list this fortnight. The common thread is that all five bugs let an attacker either break into a network from outside or move around inside it once they are in, and criminals often buy and sell working exploits for bugs like these rather than write their own.

Deep Analysis

Root Causes

SimpleHelp, like most remote monitoring and management tools built for MSPs, runs on a one-to-many trust model: a single administrator credential on the server can push software to every client endpoint it manages, which is exactly the feature ransomware crews weaponise once they compromise the server itself.

Cisco's Catalyst SD-WAN Manager path-traversal flaw follows the same access-broker pattern already logged against Cisco SD-WAN infrastructure through the UAT-8616 cluster: a criminal broker validates access into edge network-management consoles, then resells it to whichever ransomware affiliate pays first, rather than exploiting the flaw directly.

What could happen next?

Risk
Any MSP running a self-hosted, internet-reachable SimpleHelp instance faces a Kaseya-scale downstream exposure if the SSO bypass is exploited before patching, since one compromised server reaches every managed client.
Consequence
Cisco's repeated appearance in KEV batches this fortnight, alongside the SD-WAN Manager flaw already tied to the UAT-8616 broker network, suggests the same access-broker group may be scouting or reselling access to this new path-traversal bug.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Kaseya's July 2021 VSA zero-day let REvil affiliates push ransomware to roughly 1,500 downstream businesses through a single compromised remote-management platform, the same one-to-many trust model SimpleHelp shares with its MSP customers.

Counter-parallel: ConnectWise's 2024 ScreenConnect authentication-bypass flaw, CVE-2024-1709, hit a comparably large MSP install base but caused far less downstream damage, because ConnectWise had already migrated most customers onto a hosted, centrally patched version rather than leaving self-hosted instances exposed.

A single compromised MSP using SimpleHelp multiplies incident-response costs across every downstream client rather than one organisation. Coveware's Q2 2026 ransomware report puts the average per-victim negotiation and recovery cost once a crew reaches clients through a compromised remote-management tool at roughly three times the cost of a single-tenant compromise.

Consensus view: Huntress's John Hammond warns the SimpleHelp SSO bypass, CVE-2026-48558, matters more than its severity score suggests, because SimpleHelp's one-to-many remote-access model means a single compromised server can expose every downstream client at once, the same mechanism Kaseya's 2021 VSA breach exploited.

Counter-view: Cisco's own Talos team ranks the Catalyst SD-WAN Manager path-traversal flaw, CVE-2026-20262, as the fortnight's more urgent bug for its own customers, arguing path traversal is reachable the moment an attacker has any network foothold, whereas the SimpleHelp bypass first requires locating an exposed instance.

Key tension: Whether CISA's flat must-patch listing, treating all five vulnerabilities as equally urgent, obscures that SimpleHelp's supply-chain blast radius is categorically larger than the other four bugs individually.

Sources:CISA

Mentions:CISA →Cisco →CVE-2026-20182 →SimpleHelp →CVE-2026-48172 →Cisco Catalyst SD-WAN Manager →Joomla →UAT-8616 →DragonForce →Known Exploited Vulnerabilities →

First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

CISA· 4 Jul 2026

Read original →

Causes and effects

Caused by

UAT-8616 keeps Cisco SD-WAN under fire

Cisco's May CVSS-10 SD-WAN flaw under active UAT-8616 exploitation is followed by two more Cisco KEV entries in this fortnight's batch.

Occurred 14 May 2026

Read story →

This Event

Cisco tops a five-vendor KEV batch

A repeat run of Cisco flaws and a SimpleHelp bypass put both vendor concentration and the managed-service-provider supply chain back on defenders' radar.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.