Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Cisco and PTC flaws under active attack, CISA adds to KEV list

Part of the CVE-2026-20230 story · since 4 Jun

Quiet for 19 weekslast report 2 Jul16 articles7 outlets
4 Jun · SecurityOnline first23 Aug19 Sep16 OctNowThis article10th of 16
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV. This article, 10th of 16.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.

The page discusses two critical vulnerabilities that have been added to the CISA KEV Catalog on June 25, 2026. These vulnerabilities are affecting Cisco Unified Communications Manager and PTC Windchill, both of which are reportedly being actively exploited. The Cisco issue (CVE-2026-20230) is a Server-Side Request Forgery (SSRF) flaw that allows unauthorized access to the system, whereas the PTC issue (CVE-2026-12569) permits remote code execution through a deserialization vulnerability.

Both products are integral to enterprise networks, necessitating immediate updates to mitigate the risks. Users are urged to upgrade their systems before the CISA-set remediation deadline of June 28, 2026.

How the story developed

All 16 articles
Quiet for 19 weekslast report 2 Jul16 articles7 outlets

16 articles from 7 outlets since 4 Jun. Quiet since 2 Jul. This was the 10th report, 22 days after the first.

Now4 Jun81013161922252824First reportSecurityOnline · 4 Jun, 03:51This article10th of 16 · day 22
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV. This article, 10th of 16.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Thu 4 JunDay 04
    1. Cisco Unified CM SSRF flaw exposes systems to remote takeover03:51 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access08:51 · SecurityWeek · Known exploited CVE
    3. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.13:50 · Security Affairs · Known exploited CVE
    4. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public17:11 · The Hacker News · Known exploited CVE
  2. Fri 5 JunDay 11
    1. Cisco patches SSRF flaw in Unified CM enabling root access13:01 · SOCRadar · Known exploited CVE

  3. Quiet for 3 weeks

    Wed 24 JunDay 202
    1. Cisco Unified CM flaw lets hackers gain root access via SSRF05:50 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root14:10 · Security Affairs · Known exploited CVE
  4. Thu 25 JunDay 212
    1. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV22:22 · CISA · official · CISA alert · Known exploited CVE
    2. Cisco CUCM flaw allows hackers to gain root access in 24 hours22:40 · Dark Reading · Known exploited CVE
  5. Fri 26 JunDay 225
    1. Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE · This article, 10th of 16
    2. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
    3. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog06:19 · CISA · official · Known exploited CVE
    Show 2 more from 26 Jun
    1. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
    2. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  6. Quiet for 3 days

    Mon 29 JunDay 251
    1. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public03:01 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 3 days

    Thu 2 JulDay 281
    1. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-2023011:12 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in