# CISA flags PTC Windchill, Cisco CUCM exploits

Published: 2026-06-25 · Severity: high
Canonical: https://vorant.io/reports/a9a867a8-3f6f-564c-a650-cf85f48245ef/cisa-flags-ptc-windchill-cisco-cucm-exploits

> CISA added CVE-2026-12569 (PTC Windchill/FlexPLM) and CVE-2026-20230 (Cisco CUCM SSRF) to its KEV catalog based on active exploitation evidence.

CISA has catalogued two vulnerabilities under active exploitation: an improper input validation flaw in PTC Windchill and FlexPLM (CVE-2026-12569), and a server-side request forgery vulnerability in Cisco Unified Communications Manager (CVE-2026-20230). Both are being exploited in the wild and now appear in the Known Exploited Vulnerabilities catalog.

Binding Operational Directive 26-04 requires federal agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those granting total control post-exploitation. Agencies must also assess whether systems were compromised before patching. While BOD 26-04 is binding only for Federal Civilian Executive Branch agencies, CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV catalog remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-12569 (KEV), CVE-2026-20230 (KEV)

## Detection guidance (public sample)

### Suspicious Shell Spawned from Java-based Application Server (Possible Windchill/FlexPLM Exploitation)

ATT&CK: T1190

Detects cmd/powershell/script interpreters spawned directly by Java or Tomcat processes, consistent with post-exploitation of an input-validation vulnerability in a Java-based application such as PTC Windchill/FlexPLM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Shell Spawned from Java Application Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\java.exe
    - \\javaw.exe
    - \\tomcat.exe
    - \\tomcat9.exe
    - \\catalina.exe
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\cscript.exe
    - \\wscript.exe
    - \\net.exe
    - \\whoami.exe
  filter:
    CommandLine|contains:
    - C:\\Program Files\\PTC\\
    - scheduled_maintenance
  condition: selection and not filter
falsepositives:
- Legitimate administrative or maintenance scripts invoked by the Java application
  server
- Backup or monitoring agents that spawn diagnostic shells from the application JVM
level: high
tags:
- attack.t1190
id: ce69db07-c7df-5fba-846a-759f0ff09890
status: experimental
author: Vorant
```

### SSRF-style Outbound Request to Cloud Instance Metadata Endpoint

ATT&CK: T1190.001

Detects a network connection to the well-known cloud instance metadata service address, a classic SSRF exploitation objective consistent with the CUCM SSRF vulnerability described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection to Cloud Metadata Service from Server Process
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp: 169.254.169.254
    Initiated: true
  filter:
    Image|endswith:
    - \\ec2-agent.exe
    - \\cloud-agent.exe
    - \\WindowsAzureGuestAgent.exe
  condition: selection and not filter
falsepositives:
- Legitimate cloud provider guest agents or monitoring tools querying instance metadata
- Configuration management tools that read metadata for provisioning
level: medium
tags:
- attack.t1190.001
- attack.t1190
id: 985fd077-050d-5d81-9659-c37b03ff9280
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a9a867a8-3f6f-564c-a650-cf85f48245ef/cisa-flags-ptc-windchill-cisco-cucm-exploits.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup