# CISA KEV: PTC Windchill RCE and Cisco Unified CM SSRF - Critical Remote Code Execution Vulnerabilities

> CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 25, 2026: CVE-2026-12569 (PTC Windchill deserialization RCE) and CVE-2026-20230 (Cisco Unified CM SSRF with privilege escalation). Both pose immediate risk to federal enterprise and critical infrastructure with active exploitation confirmed.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0971
- **ID:** TL-2026-0971
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12569, CVE-2026-20230

## Description

On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical remote code execution vulnerabilities to its Known Exploited Vulnerabilities Catalog, signaling widespread active exploitation in the wild. CVE-2026-12569 affects PTC Windchill PDMLink and FlexPLM—enterprise product lifecycle management platforms used across manufacturing, aerospace, and defense sectors—through improper input validation enabling deserialization of untrusted data. CVE-2026-20230 affects Cisco Unified Communications Manager (UCM), a core enterprise voice/communications platform, via a server-side request forgery (SSRF) vulnerability that chains to unauthenticated remote code execution and root privilege escalation when the WebDialer service is enabled.

Both vulnerabilities represent post-exploitation control risks requiring immediate patching or air-gapping per CISA's BOD 26-04 prioritization directive. The Windchill vulnerability leverages unsafe Java/dotnet deserialization gadget chains to execute arbitrary code on systems lacking patching, affecting versions from 11.0 M030 through 13.1.3.0. The Cisco SSRF vulnerability allows unauthenticated attackers to write arbitrary files to the underlying operating system, enabling local privilege escalation to root and complete system compromise of the communications infrastructure.

Active exploitation has been confirmed by CISA and independent security researchers, with public proof-of-concept analysis available. Enterprise defenders must immediately assess internet exposure of both platforms, apply vendor patches, and enforce network segmentation to isolate potentially compromised systems. Both vulnerabilities are automatable (except Cisco SSRF manual interaction requirement) and carry the highest technical impact—total confidentiality, integrity, and availability breach of the targeted systems and downstream lateral movement.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1588 Obtain Capabilities
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1570 Lateral Tool Transfer
- T1563 Remote Service Session Hijacking
- T1005 Data from Local System
- T1113 Screen Capture
- T1219 Remote Access Tools
- T1102 Web Service
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1496 Resource Hijacking
- T1531 Account Access Removal
- T1490 Inhibit System Recovery

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Alert)](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CVE-2026-12569 - NVD National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-12569)
- [CVE-2026-20230 - NVD National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [Cisco Security Advisory - Unified CM SSRF Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW)
- [PTC Windchill Security Patch - Support Article CS473270](https://www.ptc.com/en/support/article/CS473270)
- [CVE-2026-20230: Cisco Unified CM SSRF & Root Exploit Analysis](https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/)
- [CISA Known Exploited Vulnerabilities (KEV) Catalog - CVE-2026-12569](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569)
- [CISA Known Exploited Vulnerabilities (KEV) Catalog - CVE-2026-20230](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230)
- [CISA BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)
- [CISA Forensics Triage Requirements - BOD 26-04 Implementation Guidance](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0971