Executive Summary
On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager. These vulnerabilities are actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize remediation of such high-risk vulnerabilities to protect their networks against active threats. While BOD 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to update the catalog as new vulnerabilities are identified.
Why This Matters Now
The addition of these vulnerabilities to the KEV Catalog underscores the ongoing threat posed by actively exploited vulnerabilities. Organizations must prioritize remediation efforts to mitigate potential risks and protect their networks from active cyber threats.
Attack Path Analysis
An attacker exploited a deserialization vulnerability in PTC Windchill to execute remote code, gaining initial access. They then escalated privileges by deploying webshells, enabling deeper system control. Utilizing these elevated privileges, the attacker moved laterally within the network to access sensitive data. They established command and control channels to maintain persistent access. Subsequently, the attacker exfiltrated proprietary design files and intellectual property. Finally, they deployed ransomware, encrypting critical files and disrupting operations.
Kill Chain Progression
Initial Compromise
Description
Exploited deserialization vulnerability in PTC Windchill to execute remote code.
Related CVEs
CVE-2026-12569
CVSS 9.8A critical remote code execution vulnerability in PTC Windchill and FlexPLM allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data.
Affected Products:
PTC Windchill PDMLink – 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0
PTC FlexPLM – 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0
Exploit Status:
exploited in the wildCVE-2026-20230
CVSS 8.6A server-side request forgery vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to send crafted HTTP requests, potentially leading to unauthorized actions.
Affected Products:
Cisco Unified Communications Manager – 12.5(1)SU7, 14.0(1)SU3
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Client Execution
Command and Scripting Interpreter
Valid Accounts
External Remote Services
Hijack Execution Flow
Network Service Scanning
Remote Services
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Network and Environment Segmentation
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical vulnerability exploitation risks in PTC Windchill PLM systems require immediate patching and enhanced input validation controls to prevent system compromise.
Telecommunications
Cisco Unified Communications Manager SSRF vulnerabilities enable server-side request forgery attacks, compromising unified communications infrastructure and requiring urgent remediation.
Government Administration
Federal agencies face BOD 26-04 compliance mandates for rapid KEV vulnerability remediation on publicly exposed assets granting total system control.
Manufacturing
PTC Windchill improper input validation vulnerabilities threaten product lifecycle management systems critical to manufacturing operations and intellectual property protection.
Sources
- CISA Adds Two Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- PTC Windchill and FlexPLM Critical Vulnerability Updates and Remediationhttps://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-critical-vulnerabilityVerified
- Cisco Unified Communications Manager Server-Side Request Forgery Vulnerabilityhttps://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have significantly limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial exploitation may still occur, the attacker's subsequent actions would likely be constrained, reducing the potential for further system compromise.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges and gain deeper system control would likely be constrained, reducing the risk of further system compromise.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the risk of accessing sensitive data.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely be constrained, reducing the risk of persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of data loss.
The attacker's ability to deploy ransomware and disrupt operations would likely be constrained, reducing the risk of significant operational impact.
Impact at a Glance
Affected Business Functions
- Product Lifecycle Management
- Unified Communications
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive product design data and internal communications.
Recommended Actions
Key Takeaways & Next Steps
- • Implement inline intrusion prevention systems (IPS) to detect and block exploitation attempts of known vulnerabilities.
- • Deploy zero trust segmentation to restrict lateral movement within the network.
- • Enhance east-west traffic security to monitor and control internal communications.
- • Establish egress security and policy enforcement to prevent unauthorized data exfiltration.
- • Utilize threat detection and anomaly response systems to identify and respond to suspicious activities promptly.
