CISA Adds Two Known Exploited Vulnerabilities in PTC and Cisco Products to KEV Catalog

Executive Summary

On June 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two high-risk vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating evidence of active exploitation by threat actors. The vulnerabilities are CVE-2026-12569, affecting PTC products, and CVE-2026-20230, affecting a Cisco product. The inclusion in the KEV catalog triggers a requirement for U.S. Federal Civilian Executive Branch (FCEB) agencies to patch these flaws within a specific timeframe as mandated by Binding Operational Directive (BOD) 26-04. CISA's action serves as a strong recommendation for all public and private sector organizations to prioritize the remediation of these vulnerabilities to reduce their exposure to active cyber threats.

Vulnerability Details

1. CVE-2026-12569 - PTC Windchill and FlexPLM Improper Input Validation Vulnerability:

   • Description: This vulnerability is classified as an improper input validation flaw. Such weaknesses can lead to a variety of attacks, including cross-site scripting (XSS), SQL injection, or even remote code execution, depending on how the unsanitized input is processed by the application.
   • Impact: Successful exploitation could allow an attacker to execute arbitrary code, steal sensitive data, or manipulate application behavior.

2. CVE-2026-20230 - Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability:

   • Description: This is a Server-Side Request Forgery (SSRF) vulnerability. SSRF flaws allow an attacker to trick the server-side application into making web requests to an arbitrary domain of the attacker's choosing.
   • Impact: Attackers can use SSRF to scan internal networks, access internal services, or interact with cloud provider metadata endpoints to steal credentials. It is a powerful primitive for pivoting from an external-facing application to the internal network (T1595 - Active Scanning).

Affected Systems

• PTC Products:
  • Windchill
  • FlexPLM
• Cisco Product:
  • Unified Communications Manager

Organizations using these products should consult the respective vendor advisories for specific affected versions and patching information.

Exploitation Status

Both CVE-2026-12569 and CVE-2026-20230 are confirmed by CISA to be under active exploitation in the wild. This means that threat actors have developed working exploits and are actively using them to compromise vulnerable systems. The addition to the KEV catalog elevates the urgency of remediation far beyond that of a typical vulnerability disclosure. BOD 26-04 mandates that federal agencies not only patch these vulnerabilities but also check for signs of system compromise before applying the fix.

Impact Assessment

The active exploitation of these vulnerabilities poses a significant and immediate risk to organizations.

• For PTC customers: A compromise of Windchill or FlexPLM systems could lead to the theft of highly sensitive product lifecycle management data, including intellectual property, design schematics, and bill-of-materials information. This is a critical risk for manufacturing and engineering firms.
• For Cisco customers: An SSRF flaw in Unified Communications Manager can be a gateway for attackers into the internal corporate network. It could be used to map internal infrastructure, access sensitive internal APIs, or steal cloud credentials, providing a strong foothold for further lateral movement and data exfiltration.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

1. Vulnerability Scanning: Use an up-to-date vulnerability scanner to actively scan your environment for instances of the affected PTC and Cisco products and confirm their patch status.
2. Log Analysis: For the Cisco SSRF flaw (CVE-2026-20230), analyze web server and firewall logs for any outbound requests originating from the UCM server to unexpected internal or external destinations. This is a key part of Network Traffic Analysis (D3-NTA).
3. Input Validation Monitoring: For the PTC flaw (CVE-2026-12569), configure WAF rules to detect and block common input validation attacks like XSS and SQLi payloads directed at the Windchill/FlexPLM applications.

Remediation Steps

1. Prioritize Patching: The highest priority is to apply the security patches provided by PTC and Cisco for these vulnerabilities. Due to their KEV status, these should be treated as emergency changes. This is the primary mitigation, M1051 - Update Software.
2. Assume Compromise: Before patching, follow CISA's guidance and hunt for indicators of compromise on the affected systems. If any are found, initiate a full incident response process.
3. Compensating Controls: If patching cannot be done immediately, implement compensating controls. For the SSRF flaw, use a WAF to filter requests containing URLs in parameters. For both, restrict network access to the administrative interfaces of these applications to only trusted IP addresses or networks (M1035 - Limit Access to Resource Over Network).