# CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM Unauthenticated RCE via Deserialization) and CVE-2026-20230 (Cisco Unified CM WebDialer SSRF to Root)

> CISA added two actively exploited, unauthenticated remote-code-path vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-06-25: CVE-2026-12569, a CWE-502 deserialization-of-untrusted-data flaw in PTC Windchill/FlexPLM/Creo Parametric Server (CVSS 9.8 v3.1 / 9.3 v4.0) being exploited to drop JSP web shells at scale, and CVE-2026-20230, an SSRF in Cisco Unified Communications Manager's WebDialer service (CVSS 8.6) chained via file:// payloads into arbitrary file write and root-level privilege escalation.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-08-19T13:11:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1244
- **ID:** TL-2026-1244
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Cl0p
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12569, CVE-2026-20230, CVE-2026-4681

## Description

On 2026-06-25 CISA added two critical, unauthenticated, remotely-exploitable vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, both meeting the automatic-CRITICAL-priority bar of confirmed in-the-wild exploitation against enterprise infrastructure software.

CVE-2026-12569 affects PTC Windchill and FlexPLM (product lifecycle/PLM platforms widely deployed in manufacturing, retail/footwear/apparel, and consumer goods engineering environments) as well as Creo Parametric Server (CPS). The root cause is improper input validation leading to deserialization of untrusted data (CWE-502): an unauthenticated remote attacker can submit a crafted request to the Windchill/FlexPLM application server that is deserialized without adequate type/origin checking, resulting in arbitrary code execution in the context of the application server process. All CPS versions and Windchill/FlexPLM releases prior to 11.0 M030 are affected. PTC first warned customers on 2026-06-17 and shipped a patch on 2026-06-18; despite this, mass exploitation followed almost immediately, with attackers scanning for and compromising internet-facing Windchill instances to drop JSP web shells at a consistent URI pattern (`/Windchill/login/[0-9a-f]{16}.jsp`), using an `X-windchill-req` HTTP header as part of the exploitation/tasking flow, and performing file-listing reconnaissance (writing directory listings to files such as `flst.txt`) once shell access was established. This is the second Windchill/FlexPLM vulnerability weaponized in 2026 — a related code-injection flaw, CVE-2026-4681, was disclosed and exploited in March 2026 in the same product family, indicating a pattern of attacker interest in this platform's deserialization/input-handling attack surface. Germany's BSI and BKA issued emergency notifications to domestic organizations running vulnerable Windchill/FlexPLM instances, reflecting the severity and speed of exploitation. CISA's KEV addition carried a federal civilian remediation deadline of 2026-06-28.

CVE-2026-20230 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME), specifically the WebDialer click-to-call service. The flaw is a server-side request forgery (SSRF) caused by improper input validation of specific HTTP requests processed by WebDialer: an unauthenticated remote attacker can supply a `file://` URI as part of a WebDialer request, forcing the application to resolve and write attacker-controlled content to the underlying filesystem. Prerequisite exploitation research (documented in an SSD Secure Disclosure write-up) shows the technique first abuses WebDialer to determine the true hostname of the target host, which is then leveraged in the SSRF payload to achieve a reliable file-write path. That file write, once achieved, can plant content later leveraged for code execution and privilege escalation to root on the underlying OS. WebDialer is disabled by default, which limits exposure to organizations that have enabled the click-to-call feature; there is no vendor-published workaround other than disabling WebDialer entirely if patching is not immediately possible. Cisco released fixed software (14SU6 and 15SU5) on 2026-06-03. Public, unvetted PoC exploit code became available, and threat-intelligence firm Defused Cyber observed a single source using this PoC to conduct honeypot/reconnaissance-style exploitation (e.g., attempts to create `/tmp/cve-2026-20230-test.txt`) beginning around 2026-06-22 through 2026-06-24, ahead of CISA's KEV addition on 2026-06-25 and Cisco's advisory update confirming active exploitation on 2026-07-01.

Both CVEs share a common exploitation profile — unauthenticated, remote, low-complexity, and rapidly weaponized within days of disclosure/patch availability against enterprise infrastructure platforms with typically internet- or intranet-exposed management/service interfaces — reinforcing the urgency behind CISA's KEV-driven remediation mandates.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1595.002 Active Scanning
- T1588.006 Obtain Capabilities
- T1586.002 Compromise Accounts
- T1505.003 Server Software Component
- T1074.001 Data Staged
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [PTC Windchill/FlexPLM RCE and web shell activity](https://www.helpnetsecurity.com/2026/06/29/ptc-windchill-cve-2026-12569-exploited/)
- [CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue](https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html)
- [CVE-2026-12569 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-12569)
- [Customer & Partner Updates: Remote Code Execution Vulnerability in PTC's Windchill and FlexPLM Solutions](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)
- [CVE-2026-12569: PTC Windchill and FlexPLM Remote Code Execution Vulnerability (CISA KEV)](https://threat-modeling.com/cve-2026-12569-ptc-windchill-flexplm-rce-cisa-kev/)
- [Actively exploited PTC Windchill flaw allows unauthenticated RCE](https://fieldeffect.com/blog/ptc-windchill-flaw-allows-unauthenticated-rce)
- [Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html)
- [Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [CVE-2026-20230: Cisco Unified CM SSRF](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/)
- [CVE-2026-20230: Cisco Unified Communications Manager SSRF to Remote Code Execution Vulnerability (Actively Exploited) (CISA KEV)](https://threat-modeling.com/cve-2026-20230-cisco-unified-communications-manager-ssrf-rce/)
- [CVE-2026-20230 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise](https://socradar.io/blog/cve-2026-20230-cisco-unified-cm-webdialer-ssrf/)
- [Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root](https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1244