June 2026 CVE Landscape

Recorded Future’s Insikt Group identified 59 high-impact vulnerabilities actively exploited in June 2026 (30 with Very Critical risk scores, 23 in CISA’s KEV), affecting products from 36 vendors; the report ties exploitation to multiple campaigns and threat actors (StrikeShark, Lazarus, APT36, C0XMO), documents malware and ransomware deliveries (SharkLoader, Cobalt Strike, COPPERHEDGE, EKZ, Qilin), highlights common CWEs and a high rate of RCEs, and offers PoCs and Nuclei detection templates to customers.