CISA flags PTC Windchill, Cisco CUCM exploits

Published25 June 2026 Vorant ratinghigh vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CISA added CVE-2026-12569 (PTC Windchill/FlexPLM) and CVE-2026-20230 (Cisco CUCM SSRF) to its KEV catalog based on active exploitation evidence.

Sourcecisa.gov — open the original

What to check

Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: CISA lists CVE-2026-12569 and CVE-2026-20230 as exploited in the wild.

CISA has catalogued two vulnerabilities under active exploitation: an improper input validation flaw in PTC Windchill and FlexPLM (CVE-2026-12569), and a server-side request forgery vulnerability in Cisco Unified Communications Manager (CVE-2026-20230). Both are being exploited in the wild and now appear in the Known Exploited Vulnerabilities catalog.

Binding Operational Directive 26-04 requires federal agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those granting total control post-exploitation. Agencies must also assess whether systems were compromised before patching. While BOD 26-04 is binding only for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV catalog remediation.

Mentioned in this report

Vulnerabilities CVE-2026-12569KEVCVE-2026-20230KEV

Detection guidance

Suspicious Shell Spawned from Java-based Application Server (Possible Windchill/FlexPLM Exploitation)

ATT&CK T1190 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects cmd/powershell/script interpreters spawned directly by Java or Tomcat processes, consistent with post-exploitation of an input-validation vulnerability in a Java-based application such as PTC Windchill/FlexPLM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Shell Spawned from Java Application Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\tomcat.exe
    - \\tomcat9.exe
    - \\catalina.exe
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\cscript.exe
    - \\wscript.exe
    - \\net.exe
    - \\whoami.exe
  filter:
    CommandLine|contains:
    - C:\\Program Files\\PTC\\
    - scheduled_maintenance
  condition: selection and not filter
falsepositives:
- Legitimate administrative or maintenance scripts invoked by the Java application
  server
- Backup or monitoring agents that spawn diagnostic shells from the application JVM
level: high
tags:
- attack.t1190
id: ce69db07-c7df-5fba-846a-759f0ff09890
status: experimental
author: Vorant

SSRF-style Outbound Request to Cloud Instance Metadata Endpoint

ATT&CK T1190 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a network connection to the well-known cloud instance metadata service address, a classic SSRF exploitation objective consistent with the CUCM SSRF vulnerability described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound Connection to Cloud Metadata Service from Server Process
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp: 169.254.169.254
    Initiated: true
  filter:
    Image|endswith:
    - \\ec2-agent.exe
    - \\cloud-agent.exe
    - \\WindowsAzureGuestAgent.exe
  condition: selection and not filter
falsepositives:
- Legitimate cloud provider guest agents or monitoring tools querying instance metadata
- Configuration management tools that read metadata for provisioning
level: medium
tags:
- attack.t1190
id: 985fd077-050d-5d81-9659-c37b03ff9280
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs