Loading story…
CISA added two newly exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-12569 in PTC Windchill and FlexPLM and CVE-2026-20230 in Cisco Unified Communications Manager and Unified CM SME. The PTC issue is a critical unauthenticated remote code execution flaw tied to improper input validation or deserialization, affecting multiple Windchill and FlexPLM releases, while the Cisco issue is a critical server-side request forgery vulnerability that can be triggered through crafted HTTP requests when the WebDialer service is enabled. CISA set a June 28 remediation deadline for federal civilian agencies under its binding directive and urged broader review of exposed systems.
PTC said CVE-2026-12569 has now been confirmed exploited in the wild for the first time, with attackers reportedly deploying persistent JSP webshells for remote command execution and data exfiltration after sending specially crafted requests. PTC began releasing patches and mitigations earlier and later published indicators of compromise, while German police also warned organizations of imminent attacks. Cisco warned that public proof-of-concept code exists for CVE-2026-20230 and that successful exploitation could let attackers interact with internal services, write files to the underlying operating system, and potentially escalate privileges to root, raising concern for enterprises that rely on these communications and product lifecycle management platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Ransom-ISAC reported that starting on July 20, 2026, affiliates of the Cl0p ransomware group targeted Internet-exposed PTC Windchill and FlexPLM instances in a data-extortion campaign. The activity reportedly involved chaining a FlexPLM WSDL information-disclosure issue with unauthenticated RCE in the Windchill login servlet, followed by JSP web shell deployment, data exfiltration, and extortion emails sent to hundreds of users.
German police issued a warning to organizations about imminent attacks involving the PTC Windchill vulnerability. The warning was cited alongside reports of active exploitation activity.
PTC released indicators of compromise and said attackers were deploying persistent JSP webshells for remote command execution and data exfiltration on vulnerable systems. The company also said it had received reports of heightened threat activity.
CISA added CVE-2026-12569 to the KEV catalog as an actively exploited vulnerability and required federal civilian agencies to remediate by June 28, 2026. Reporting described this as the first confirmed in-the-wild exploitation of the PTC Windchill flaw.
CISA updated its Known Exploited Vulnerabilities catalog to add CVE-2026-12569 in PTC Windchill/FlexPLM and CVE-2026-20230 in Cisco Unified Communications Manager. The catalog update set a remediation due date of June 28, 2026 for both vulnerabilities.
PTC started publishing patches and mitigations for CVE-2026-12569, a remote code execution flaw affecting Windchill and FlexPLM. The vendor later also warned of active threat activity targeting the vulnerability.
Cisco released a patch for CVE-2026-20230, a critical unauthenticated SSRF vulnerability in Unified Communications Manager Server. Later reporting said the flaw was being actively exploited to write arbitrary text files to affected endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecyberveille.ch
Open sourceransom-isac.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourcecisa.gov
Open sourceptc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PTC disclosed **CVE-2026-4681**, a critical deserialization flaw in **Windchill PDMLink** and **FlexPLM** that can allow **remote code execution**. The vulnerability affects multiple major release branches, including **11.x, 12.x, and 13.x**, with impacted builds including CPS releases before **11.0 M030**. PTC rated the issue **CVSS v3.1 10.0** and **CVSS v4 9.3**, and said the risk is highest for **publicly accessible instances**. PTC said it has **no evidence of active exploitation affecting customers** at this time, but issued urgent mitigation guidance while patches are pending. The company advised administrators to apply protections in **Apache HTTP Server** and **Microsoft IIS**, extend the same controls to **File Server** and **Replica Server** deployments, and disconnect exposed systems or shut services down if mitigations cannot be applied. PTC also published **indicators of compromise**, including suspicious HTTP request patterns, a specific Chrome user-agent string, malicious filenames, a `payload.bin` SHA-256 hash, and related log messages; for **PTC cloud-hosted** customers, the Apache workaround has already been deployed.
Jun 30, 2026
PTC Windchill PDMLink and FlexPLM are facing active exploitation of **`CVE-2026-4681`**, a critical remote code execution flaw caused by deserialization of untrusted data. Splunk published detection guidance describing suspicious HTTP patterns tied to exploitation, including requests containing `run?c=`, `run?p=`, `.jsp?c=`, and `.jsp?p=`, as well as the indicator `GW_READY_OK`. The activity suggests attackers may deploy staged gateway or JSP components, use the `c=` parameter to run operating system commands such as `whoami`, and abuse the `p=` parameter to read files from affected servers. Defenders are being urged to apply PTC’s mitigation and patching guidance and to hunt for related artifacts across compromised environments. Splunk recommends monitoring Windchill MethodServer `log4j` telemetry, particularly servlet-related loggers, and checking file systems for indicators such as `GW.class`, `payload.bin`, and randomly named `dpr_<8 hex>.jsp` files. A Siemens product advisory was also referenced in the reporting set, indicating broader vendor awareness around the issue and the need for rapid validation of exposure in enterprise environments.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026