Inferlume

Network Infrastructure Attack Surface

• The primary exposure vector confronting enterprise networks involves a persistent campaign directed at the Cisco Catalyst SD-WAN architecture. The disclosure of CVE-2026-20245 introduces an unpatched zero-day vulnerability affecting the Catalyst SD-WAN Manager. This flaw permits remote unauthenticated adversaries to execute arbitrary commands with root privileges directly on the underlying operating system.

• This newest vulnerability builds upon an established exploitation chain involving CVE-2026-20182 and CVE-2026-20127. In these scenarios, the broken logic sits within the control connection handshake of the vdaemon service, which communicates over DTLS via UDP port 12346. When a connecting entity identifies itself as a vHub device, the daemon skips the standard device-type certificate validations while erroneously marking the connection state as authenticated.

• This design and validation failure permits unauthenticated network actors to impersonate trusted SD-WAN components. Once inside, the adversary interacts with the management layer, enabling them to inject an attacker-controlled SSH public key into the authorized_keys file of the high-privilege vmanage-admin local account.

• With root-equivalent SSH access established, attackers leverage the NETCONF protocol over ports 22 or 830 to read or push malicious configuration templates, modify routing policies, intercept or mirror traffic across the wider network fabric, or initiate software version downgrades as an anti-forensic measure to hinder detection.

• Consulted sources indicate that this vulnerability class affects all deployment architectures. On-premises installations, Cisco Hosted SD-WAN Cloud, Cisco Managed systems, and FedRAMP-regulated government environments are equally vulnerable if their control planes are exposed to untrusted traffic. The threat group UAT-8616 has been tracked weaponizing this vector since 2023, and public proof-of-concept availability has drawn at least 10 other threat clusters to opportunistically target unpatched nodes.

E-Commerce and Web Application Exposure

• Concurrently, a severe application-layer threat is expanding across public-facing retail assets via CVE-2026-45247. This vulnerability resides within the Mirasvit Full Page Cache Warmer extension for Magento 2 e-commerce platforms.

• The exposure is highly operationalizable because it requires zero authentication, no pre-existing user session, and no specific non-default configuration parameters. The vulnerability maps to an unauthenticated PHP object injection flaw that occurs when the extension parses the CacheWarmer HTTP cookie during standard storefront page requests.

• Because the plugin deserializes the incoming cookie string without restricting acceptable classes or enforcing input sanitization, an attacker can transmit a base64-encoded serialized PHP object payload. By pairing this payload with standard PHP gadget chains present in common Magento 2 dependencies such as Laminas, Zend Framework, or Symfony components, the adversary triggers automatic deserialization that executes arbitrary code within the context of the underlying web server user.

• This flaw allows threat groups to easily plant web shells, exfiltrate customer personal data, modify transaction databases, or deploy malicious JavaScript payment card skimmers directly into checkout pages. CISA added this vulnerability to the KEV catalog on June 4 2026, establishing an aggressive compliance deadline of June 6 2026, confirming that real-world exploitation is widespread and moving faster than typical organizational patch cycles.

Endpoint, Host, and Container Escape Exposures

• The final core exposure vector involves an immediate remediation deadline on June 5 2026 for two high-severity flaws that target client endpoint and server virtualization layers: CVE-2025-48595 and CVE-2022-0492.

• CVE-2025-48595 represents a local privilege escalation vulnerability within the Android Framework impacting devices running Android version 14 and above. It is rooted in an integer overflow condition that permits an attacker or a malicious unprivileged application running in a restricted user sandbox to bypass standard permission structures, compromise memory spaces in the system renderer, and execute code with elevated system privileges without requiring user interaction. Consulted sources state that this flaw has been leveraged in limited, highly targeted environments, which typically indicates utilization by advanced commercial spyware operators or state-aligned actors tracking specific high-value personnel.

• CVE-2022-0492 addresses a legacy privilege escalation flaw located in the Linux kernel cgroups v1 implementation, specifically within the kernel/cgroup/cgroup-v1.c source file. The cgroup_release_agent_write function fails to validate whether the invoking process possesses the CAP_SYS_ADMIN capability inside its respective user namespace.

• Consequently, a local process running inside a containerized workspace can write a custom execution path into the release_agent file and trigger execution by cycling a child cgroup. This forces the host kernel to run the attacker's script as root outside the container context. The sudden addition of this 2022 vulnerability to the CISA KEV catalog highlights that threat groups are actively scanning for unpatched legacy distributions, embedded architectures, and Kubernetes or Docker hosts where kernel updates have been neglected and cgroups v1 remains active.

Technical Watchlist and Low-Risk Signals

• Several secondary, medium-severity application vulnerabilities were tracked during this window but do not currently alter the macro threat baseline. CVE-2026-11051 covers an out-of-bounds read within the ANGLE graphics translation component of Chrome for Linux, creating a potential primitive for memory corruption attacks.

• CVE-2026-50591 was introduced as a medium-severity issue affecting the Znuny helpdesk ticketing system, though technical details regarding its exploitation mechanism remain restricted. CVE-2026-9516 was documented as a moderate denial-of-service vulnerability within the perl-Cpanel-JSON-XS parser on Fedora 44, creating a crash risk when processing malformed JSON structures. These issues are currently contained and belong in standard, non-emergency patch windows.