CISA Sets June 28 Deadline to Address Cisco and PTC Vulnerabilities
Summary
CISA set a June 28 deadline for federal agencies to patch or stop using products affected by CVE-2026-20230 and CVE-2026-12569. Cisco's SSRF flaw is being exploited to write arbitrary text files; PTC's is a critical deserialization-based RCE.
Key points
- CISA added CVE-2026-20230 and CVE-2026-12569 to its Known Exploited Vulnerabilities catalog and set a June 28 remediation deadline for federal agencies.
- Defused observed CVE-2026-20230, an SSRF flaw in Cisco Unified Communications Manager Server, being used to write arbitrary text files; the actor is unknown.
- Cisco released a patch for CVE-2026-20230 on June 3; the article says the flaw can be exploited remotely without authentication using specially crafted HTTP requests.
- CVE-2026-12569 is a critical deserialization-based remote code execution flaw affecting PTC Windchill and FlexPLM.
- PTC's advisory lists affected versions across several release branches; agencies subject to BOD 26-04 must patch, apply vendor-recommended mitigations, or stop using the affected products by the deadline.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Improper input validation
- Remote code execution through deserialization of untrusted data
- Severity
- Critical
- Affected Versions
- PTC Windchill and FlexPLM: all versions up to 11.0 and multiple versions in the 11.1, 11.2, 12.0, 12.1, and 13.0 release branches
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Stop using affected products by June 28 if they have not been remediated.
CVE
CVE-2026-12569CISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.CVE-2026-20230CISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.
Vendors
CiscoCISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.PTCCISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.
Products
Cisco Unified Communications Manager ServerCISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.PTC FlexPLMCISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.PTC WindchillCISA has ordered federal agencies to patch two actively exploited critical vulnerabilities by June 28: CVE-2026-20230 in Cisco Unified Communications Manager Server and CVE-2026-12569 in PTC Windchill and FlexPLM.
Countries
Industries
ApparelBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.Consumer productsBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.EngineeringBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.FootwearBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.ManufacturingBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.RetailBoth are product lifecycle management (PLM) systems developed by PTC specifically for the manufacturing, engineering, retail, footwear, apparel, and consumer products industries.