CISA flags PTC Windchill, Cisco CUCM exploits
CISA added CVE-2026-12569 (PTC Windchill/FlexPLM) and CVE-2026-20230 (Cisco CUCM SSRF) to its KEV catalog based on active exploitation evidence.
CISA has catalogued two vulnerabilities under active exploitation: an improper input validation flaw in PTC Windchill and FlexPLM (CVE-2026-12569), and a server-side request forgery vulnerability in Cisco Unified Communications Manager (CVE-2026-20230). Both are being exploited in the wild and now appear in the Known Exploited Vulnerabilities catalog.
Binding Operational Directive 26-04 requires federal agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those granting total control post-exploitation. Agencies must also assess whether systems were compromised before patching. While BOD 26-04 is binding only for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV catalog remediation.
Mentioned in this report
Detection guidance
Suspicious Shell Spawned from Java-based Application Server (Possible Windchill/FlexPLM Exploitation)
Detects cmd/powershell/script interpreters spawned directly by Java or Tomcat processes, consistent with post-exploitation of an input-validation vulnerability in a Java-based application such as PTC Windchill/FlexPLM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned from Java Application Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \\java.exe
- \\javaw.exe
- \\tomcat.exe
- \\tomcat9.exe
- \\catalina.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\cscript.exe
- \\wscript.exe
- \\net.exe
- \\whoami.exe
filter:
CommandLine|contains:
- C:\\Program Files\\PTC\\
- scheduled_maintenance
condition: selection and not filter
falsepositives:
- Legitimate administrative or maintenance scripts invoked by the Java application
server
- Backup or monitoring agents that spawn diagnostic shells from the application JVM
level: high
tags:
- attack.t1190
id: ce69db07-c7df-5fba-846a-759f0ff09890
status: experimental
author: Vorant
SSRF-style Outbound Request to Cloud Instance Metadata Endpoint
Detects a network connection to the well-known cloud instance metadata service address, a classic SSRF exploitation objective consistent with the CUCM SSRF vulnerability described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection to Cloud Metadata Service from Server Process
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp: 169.254.169.254
Initiated: true
filter:
Image|endswith:
- \\ec2-agent.exe
- \\cloud-agent.exe
- \\WindowsAzureGuestAgent.exe
condition: selection and not filter
falsepositives:
- Legitimate cloud provider guest agents or monitoring tools querying instance metadata
- Configuration management tools that read metadata for provisioning
level: medium
tags:
- attack.t1190.001
- attack.t1190
id: 985fd077-050d-5d81-9659-c37b03ff9280
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free