# CISA flags Cisco SD-WAN, LiteSpeed cPanel exploits

Published: 2026-06-15 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/c94ba534-f6b6-5ec6-80d5-7cba1af0745e/cisa-flags-cisco-sd-wan-litespeed-cpanel-exploits

> CISA added two actively exploited vulnerabilities—CVE-2026-20262 in Cisco Catalyst SD-WAN Manager and CVE-2026-54420 in LiteSpeed cPanel Plugin—to its KEV catalog.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation in the wild. CVE-2026-20262 is a directory or path traversal vulnerability in Cisco Catalyst SD-WAN Manager, while CVE-2026-54420 is a UNIX symbolic link following vulnerability in the LiteSpeed cPanel Plugin. Both flaws are being leveraged as attack vectors by malicious cyber actors.

The additions reinforce CISA's Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities—specifically those in the KEV catalog on publicly exposed assets that grant total control post-exploitation. The directive updates BOD 22-01 and establishes expectations for agencies to assess whether systems were compromised before patches were applied.

While BOD 26-04 applies only to federal agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV catalog entries. Organizations can submit newly discovered exploited vulnerabilities for potential inclusion via CISA's KEV Nomination Form.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20262 (KEV), CVE-2026-54420 (KEV)

## Detection guidance (public sample)

### Possible Path Traversal Attempt Against Cisco SD-WAN Manager Web Interface

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences targeting Cisco Catalyst SD-WAN Manager management endpoints, consistent with exploitation of CVE-2026-20262. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Path Traversal Attempt Against Cisco SD-WAN Manager Web Interface
id: 55a07eaa-196f-5a54-bb43-abcc3f694653
status: experimental
description: Detects HTTP requests with directory traversal patterns (../ or encoded
  equivalents) sent to Cisco SD-WAN Manager web management URIs, which may indicate
  exploitation of CVE-2026-20262.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: proxy
  product: null
detection:
  selection:
    c-uri|contains:
    - ../
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e/'
  filter:
    c-uri|contains:
    - /static/
    - /assets/
  condition: selection and not filter
falsepositives:
- Legitimate vulnerability scanning or penetration testing against the management
  interface
- Misconfigured proxies or CDNs rewriting URLs with encoded dot-dot sequences
level: medium
tags:
- attack.initial_access
- attack.t1190
author: Vorant
```

### Suspicious Symlink Creation by cPanel or LiteSpeed Web Server Process

ATT&CK: T1222.002

Detects a web server or cPanel-related process creating symbolic links, which may indicate exploitation of the LiteSpeed cPanel plugin symlink-following vulnerability (CVE-2026-54420) to escalate privileges or read/write outside intended directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Symlink Creation by cPanel or LiteSpeed Web Server Process
id: 398b1d01-4181-56c6-b84e-0b4cd568de75
status: experimental
description: Detects the ln command with symlink flags being executed by processes
  associated with cPanel or LiteSpeed web server services, consistent with exploitation
  attempts of CVE-2026-54420 (UNIX symlink following vulnerability in LiteSpeed cPanel
  Plugin).
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /ln
    CommandLine|contains:
    - '-s '
    - --symbolic
  parent_selection:
    ParentImage|contains:
    - litespeed
    - lscpd
    - cpanel
    - cpsrvd
  condition: selection and parent_selection
falsepositives:
- Legitimate cPanel or LiteSpeed maintenance scripts that create symlinks as part
  of normal configuration
- Administrator-run automation scripts invoked under the web server service account
level: high
tags:
- attack.privilege_escalation
- attack.defense_evasion
- attack.t1222.002
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c94ba534-f6b6-5ec6-80d5-7cba1af0745e/cisa-flags-cisco-sd-wan-litespeed-cpanel-exploits.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup