CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM Unauthenticated RCE via Deserialization) and CVE-2026-20230 (Cisco Unified CM WebDialer SSRF to Root)

CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM (TL-2026-1244) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-25 and last reviewed 2026-08-19. It is attributed to Cl0p with medium confidence, affects PTC Windchill, references 3 CVEs (CVE-2026-12569, CVE-2026-20230, CVE-2026-4681), maps to 22 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1244

Threat ID
TL-2026-1244
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-25
Last reviewed
2026-08-19
Attribution
Cl0p
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
manufacturing, retail, consumergoods, telecoms, health, government administration, financialservices
Target regions
North America, Europe
Detection rules
9
Indicators of compromise
25
Updates
2026-08-19 · 2 updates · revalidated 1×

Malware and tooling in CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

Malware and tooling: N/A-webshell-generic

CISA added two actively exploited, unauthenticated remote-code-path vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-06-25: CVE-2026-12569, a CWE-502 deserialization-of-untrusted-data flaw in PTC Windchill/FlexPLM/Creo Parametric Server (CVSS 9.8 v3.1 / 9.3 v4.0) being exploited to drop JSP web shells at scale, and CVE-2026-20230, an SSRF in Cisco Unified Communications Manager's WebDialer service (CVSS 8.6) chained via file:// payloads into arbitrary file write and root-level privilege escalation.

How CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM works

On 2026-06-25 CISA added two critical, unauthenticated, remotely-exploitable vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, both meeting the automatic-CRITICAL-priority bar of confirmed in-the-wild exploitation against enterprise infrastructure software.

CVE-2026-12569 affects PTC Windchill and FlexPLM (product lifecycle/PLM platforms widely deployed in manufacturing, retail/footwear/apparel, and consumer goods engineering environments) as well as Creo Parametric Server (CPS). The root cause is improper input validation leading to deserialization of untrusted data (CWE-502): an unauthenticated remote attacker can submit a crafted request to the Windchill/FlexPLM application server that is deserialized without adequate type/origin checking, resulting in arbitrary code execution in the context of the application server process. All CPS versions and Windchill/FlexPLM releases prior to 11.0 M030 are affected. PTC first warned customers on 2026-06-17 and shipped a patch on 2026-06-18; despite this, mass exploitation followed almost immediately, with attackers scanning for and compromising internet-facing Windchill instances to drop JSP web shells at a consistent URI pattern (`/Windchill/login/[0-9a-f]{16}.jsp`), using an `X-windchill-req` HTTP header as part of the exploitation/tasking flow, and performing file-listing reconnaissance (writing directory listings to files such as `flst.txt`) once shell access was established. This is the second Windchill/FlexPLM vulnerability weaponized in 2026 — a related code-injection flaw, CVE-2026-4681, was disclosed and exploited in March 2026 in the same product family, indicating a pattern of attacker interest in this platform's deserialization/input-handling attack surface. Germany's BSI and BKA issued emergency notifications to domestic organizations running vulnerable Windchill/FlexPLM instances, reflecting the severity and speed of exploitation. CISA's KEV addition carried a federal civilian remediation deadline of 2026-06-28.

CVE-2026-20230 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME), specifically the WebDialer click-to-call service. The flaw is a server-side request forgery (SSRF) caused by improper input validation of specific HTTP requests processed by WebDialer: an unauthenticated remote attacker can supply a `file://` URI as part of a WebDialer request, forcing the application to resolve and write attacker-controlled content to the underlying filesystem. Prerequisite exploitation research (documented in an SSD Secure Disclosure write-up) shows the technique first abuses WebDialer to determine the true hostname of the target host, which is then leveraged in the SSRF payload to achieve a reliable file-write path. That file write, once achieved, can plant content later leveraged for code execution and privilege escalation to root on the underlying OS. WebDialer is disabled by default, which limits exposure to organizations that have enabled the click-to-call feature; there is no vendor-published workaround other than disabling WebDialer entirely if patching is not immediately possible. Cisco released fixed software (14SU6 and 15SU5) on 2026-06-03. Public, unvetted PoC exploit code became available, and threat-intelligence firm Defused Cyber observed a single source using this PoC to conduct honeypot/reconnaissance-style exploitation (e.g., attempts to create `/tmp/cve-2026-20230-test.txt`) beginning around 2026-06-22 through 2026-06-24, ahead of CISA's KEV addition on 2026-06-25 and Cisco's advisory update confirming active exploitation on 2026-07-01.

Both CVEs share a common exploitation profile — unauthenticated, remote, low-complexity, and rapidly weaponized within days of disclosure/patch availability against enterprise infrastructure platforms with typically internet- or intranet-exposed management/service interfaces — reinforcing the urgency behind CISA's KEV-driven remediation mandates.

MITRE ATT&CK techniques used in TL-2026-1244

Collection

T1005 Data from Local System; T1074.001 Data Staged

Discovery

T1016 System Network Configuration Discovery; T1083 File and Directory Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component; T1505.003 Server Software Component

Resource Development

T1586.002 Compromise Accounts; T1588 Obtain Capabilities; T1588.006 Obtain Capabilities

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning

Impact

T1657 Financial Theft

Affected products and versions in CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

  • PTC — Windchill
    Vulnerable versions: all releases prior to 11.0 M030
    Fixed in: 11.0 M030 and later
  • PTC — FlexPLM
    Vulnerable versions: all releases prior to 11.0 M030
    Fixed in: 11.0 M030 and later
  • PTC — Creo Parametric Server (CPS)
    Vulnerable versions: all versions
    Fixed in: version bundled with Windchill/FlexPLM 11.0 M030 patch
  • Cisco — Unified Communications Manager (Unified CM)
    Vulnerable versions: releases prior to 14SU6
    Fixed in: 14SU6
  • Cisco — Unified Communications Manager Session Management Edition (Unified CM SME)
    Vulnerable versions: releases prior to 15SU5
    Fixed in: 15SU5

Remediation for CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

Patches

  • PTC Windchill/FlexPLM/Creo Parametric Server: upgrade to 11.0 M030 or later (patch released 2026-06-18)
  • Cisco Unified CM: upgrade to 14SU6
  • Cisco Unified CM SME: upgrade to 15SU5 (both released 2026-06-03)

Immediate actions

  • Apply PTC's Windchill/FlexPLM/CPS patch bringing installations to 11.0 M030 or later immediately
  • Apply Cisco Unified CM 14SU6 or Unified CM SME 15SU5
  • Disable the Cisco WebDialer service if patching Unified CM/SME cannot happen immediately (Cisco Unified Serviceability > Tools > Service Activation > CTI Services > uncheck Cisco WebDialer Web Service)
  • Hunt for JSP web shells at the path pattern /Windchill/login/[0-9a-f]{16}.jsp on all internet- and intranet-facing Windchill/FlexPLM servers
  • Block outbound/inbound traffic to known suspicious IPs 172.111.38.31, 216.152.148.54, 104.243.35.131, 74.50.76.146, and 5.180.41.35 at the perimeter
  • Hunt for the file flst.txt in Windchill working directories or /tmp as an indicator of successful compromise
  • Review WebDialer/CUCM logs for anomalous file:// URI requests and unexpected file-write attempts such as /tmp/cve-2026-20230-test.txt

Workarounds

  • Disable Cisco WebDialer service via Cisco Unified Serviceability administration if immediate patching of Unified CM/SME is not possible
  • No vendor-published workaround exists for CVE-2026-12569; restrict network access to Windchill/FlexPLM as an interim compensating control

Longer-term hardening

  • Remove direct internet exposure of Windchill/FlexPLM administration and login endpoints; place behind VPN or zero-trust access proxy
  • Disable WebDialer permanently in environments that do not use click-to-call functionality
  • Deploy EDR/behavioral detection on PLM and UC application servers to catch webshell drops and unexpected JSP deployment
  • Establish a vulnerability-management SLA tied to CISA KEV additions for internet-facing enterprise infrastructure software
  • Segment PLM and Unified Communications infrastructure from general enterprise networks to limit blast radius of RCE/root compromise

CVEs associated with CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

CVE-2026-12569, CVE-2026-20230, CVE-2026-4681

Weaknesses (CWE) in CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

CWE-502, CWE-918, CWE-20, CWE-94

Timeline of CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

  • CVE-2026-4681, an earlier code-injection RCE flaw in PTC Windchill/FlexPLM, is disclosed and exploited, foreshadowing continued attacker interest in the product family.
  • Cisco releases fixed software for CVE-2026-20230: Unified CM 14SU6 and Unified CM SME 15SU5.
  • PTC issues initial customer warning and remediation guidance for CVE-2026-12569 ahead of patch release.
  • PTC releases the first patch for CVE-2026-12569 (Windchill/FlexPLM/CPS 11.0 M030); in-the-wild exploitation is confirmed almost immediately.
  • Defused Cyber observes a single source using an unvetted public PoC to exploit CVE-2026-20230, including reconnaissance file-write attempts such as /tmp/cve-2026-20230-test.txt.
  • Active exploitation of CVE-2026-20230 is confirmed in the wild via honeypot telemetry.
  • PTC confirms heightened threat activity against Windchill/FlexPLM, with attackers deploying JSP web shells at the URI pattern /Windchill/login/[0-9a-f]{16}.jsp.
  • CISA adds both CVE-2026-12569 and CVE-2026-20230 to the Known Exploited Vulnerabilities (KEV) catalog, citing confirmed active exploitation of both.
  • The Hacker News and other outlets report on continued web shell attacks against PTC Windchill and on CVE-2026-20230 exploitation following PoC-driven attacks.
  • CISA's federal civilian executive branch remediation deadline for CVE-2026-12569 (and CVE-2026-20230) is reached.
  • Detailed technical writeups on PTC Windchill web shell activity and IOCs are published by security researchers (Help Net Security).
  • Cisco updates its security advisory for CVE-2026-20230 to formally confirm active exploitation in the wild.
  • Cl0p begins sending mass extortion emails to hundreds of employees per victim organization from compromised third-party email accounts.
  • Ransom-ISAC issues an advisory warning that Cl0p is actively exploiting the Windchill/FlexPLM chain for data theft and extortion.
  • The Hacker News and other outlets report Cl0p affiliates targeting internet-exposed Windchill/FlexPLM instances in a global engineering-data-theft campaign.
  • Cl0p publicly lists close to 50 companies, including Shell, Philips, GE and Fiserv, on its dark-web extortion/leak site.
  • Reuters and multiple outlets report the claims publicly; Philips confirms a contained compromise of an enterprise server, Fiserv finds no evidence of customer-data impact, and GE says it has initiated cyber response protocols.
  • Shell confirms it is investigating the claim, without confirming any data was actually exfiltrated.

Update history for TL-2026-1244

Sources cited for CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

Threats related to CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM

Detection coverage for TL-2026-1244

As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1244 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats