CISA ADDS TWO ACTIVELY EXPLOITED VULNERABILITIES TO KNOWN EXPLOITED VULNERABILITIES CATALOG

Threat Summary

Category: Vulnerability Alert
Affected Technology: PTC Windchill, PTC FlexPLM, Cisco Unified Communications Manager
Primary Risk: Improper Input Validation and Server-Side Request Forgery (SSRF)
Exploitation Status: Active Exploitation Confirmed
Target Environment: Federal Civilian Executive Branch Agencies, Enterprises Utilizing Affected Platforms
Operational Impact: Potential Unauthorized Access, Internal Resource Manipulation, and Enterprise System Compromise
Threat Surface: Internet-Accessible PTC Windchill/FlexPLM Deployments and Cisco Unified Communications Manager Servers

---

The Cybersecurity and Infrastructure Security Agency (CISA) has added two additional vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after determining there is evidence that both flaws are being actively exploited by threat actors.

The newly added vulnerabilities are CVE-2026-12569, affecting PTC Windchill and FlexPLM, which CISA identifies as an Improper Input Validation Vulnerability, and CVE-2026-20230, affecting Cisco Unified Communications Manager, which CISA classifies as a Server-Side Request Forgery (SSRF) Vulnerability.

The addition of both vulnerabilities to the KEV Catalog signifies that exploitation has moved beyond theoretical risk and into confirmed real-world attack activity. CISA continues to identify actively exploited vulnerabilities as one of the most significant security risks facing federal agencies and private-sector organizations operating exposed infrastructure.

---

Vulnerability Breakdown

CVE-2026-12569

• Affects PTC Windchill and FlexPLM
• Classified as an Improper Input Validation Vulnerability
• Added to the KEV Catalog following confirmation of active exploitation

CVE-2026-20230

• Affects Cisco Unified Communications Manager
• Classified as a Server-Side Request Forgery (SSRF) Vulnerability
• Added to the KEV Catalog following confirmation of active exploitation

CISA has not released technical details describing how either vulnerability is currently being exploited. The agency’s decision to include both CVEs in the KEV Catalog confirms that sufficient evidence of active exploitation has been validated.

---

Infrastructure at Risk

• PTC Windchill deployments
• PTC FlexPLM deployments
• Cisco Unified Communications Manager servers
• Federal Civilian Executive Branch environments utilizing affected products
• Enterprise organizations operating exposed PTC infrastructure
• Enterprise organizations operating Cisco Unified Communications Manager deployments

---

Threat Activity

The Known Exploited Vulnerabilities Catalog serves as CISA’s operational list of vulnerabilities confirmed to be under active exploitation.

Threat actors routinely prioritize vulnerabilities that provide opportunities to gain unauthorized access, pivot within enterprise environments, exploit trusted internal communications, or compromise business-critical infrastructure. Once a vulnerability is added to the KEV Catalog, it becomes a higher-priority remediation item because exploitation has already been observed in operational environments.

CISA continues evaluating newly disclosed vulnerabilities for inclusion when they satisfy three core criteria:

• A valid CVE identifier
• Credible evidence of active exploitation
• Available mitigation or remediation guidance

---

Policy / Allied Pressure

The additions fall under Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, which establishes vulnerability management requirements for Federal Civilian Executive Branch agencies.

BOD 26-04 requires federal agencies to rapidly remediate high-risk vulnerabilities included within the KEV Catalog, particularly vulnerabilities affecting publicly exposed systems that could provide attackers with significant control following successful exploitation.

The directive also requires agencies to determine whether systems were compromised before remediation efforts were completed, recognizing that attackers may have already established persistence prior to patch deployment.

Although BOD 26-04 applies specifically to federal agencies, CISA continues encouraging state governments, critical infrastructure operators, private-sector organizations, and other network defenders to adopt risk-based vulnerability management practices that prioritize vulnerabilities listed within the KEV Catalog.

---

Vendor Defense / Reliance

Organizations utilizing affected PTC or Cisco products should:

• Identify affected systems across enterprise environments
• Review vendor security advisories and available mitigation guidance
• Apply available security updates as soon as operationally possible
• Prioritize internet-facing assets
• Review systems for indicators of compromise
• Monitor authentication and administrative activity
• Validate system integrity following remediation
• Continue monitoring for suspicious post-remediation activity

---

Forecast — 30 Days

• Accelerated patching across federal agencies
• Increased remediation activity involving PTC Windchill and FlexPLM deployments
• Increased attention on Cisco Unified Communications Manager environments
• Continued enterprise vulnerability assessments targeting exposed assets
• Additional KEV Catalog updates as CISA validates newly exploited vulnerabilities
• Ongoing monitoring for follow-on exploitation attempts against unpatched systems

---

TRJ Verdict

The addition of CVE-2026-12569 and CVE-2026-20230 to CISA’s Known Exploited Vulnerabilities Catalog confirms that both vulnerabilities are being leveraged in active attacks rather than remaining theoretical security concerns.

Organizations operating affected PTC Windchill, FlexPLM, or Cisco Unified Communications Manager deployments should treat these vulnerabilities as high-priority remediation items. For defenders, the most significant development is not the disclosure itself but CISA’s confirmation that exploitation has already been observed in operational environments, making rapid patching, compromise assessment, and continuous monitoring essential.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---