Forwarded from TWCERTCC Security Advisory TWCERTCC-200-202606-00000017

【CVE-2026-54420】LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability (CVSS v3.1: 8.5)
【Whether exploited by ransomware: Unknown】 The LiteSpeed cPanel Plugin has a UNIX symbolic link following vulnerability. On shared hosting servers running CloudLinux/CageFS, users with FTP or Web Shell access may exploit this vulnerability to perform unauthorized operations.

【CVE-2026-20262】Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability (CVSS v3.1: 6.5)
【Whether exploited by ransomware: Unknown】 Cisco Catalyst SD-WAN Manager has a directory or path traversal vulnerability. An authenticated remote attacker may exploit this vulnerability to create files or overwrite arbitrary files in the file system of the affected system.

【CVE-2026-48907】Widget Factory Joomla Content Editor Improper Access Control Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 Widget Factory Joomla Content Editor has an improper access control vulnerability, which may allow unauthenticated users to upload and execute PHP code by creating a new editor configuration file.

【CVE-2026-20253】Splunk Enterprise Missing Authentication for Critical Function Vulnerability (CVSS v3.1: 9.8)
【Whether exploited by ransomware: Unknown】 Splunk Enterprise has a Missing Authentication for Critical Function vulnerability. An unauthenticated user may create or truncate arbitrary files through the PostgreSQL Sidecar service endpoint.