SecurityOnlineDo Son
Cisco SD-WAN Zero-Day Exploited in Attacks
Part of the CVE-2026-12569 story · since 25 Jun
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV. This article, 7th of 11.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
An alert has been issued regarding two critical vulnerabilities: CVE-2026-12569 affecting PTC Windchill and FlexPLM, and CVE-2026-20230 related to Cisco Unified Communications Manager. A detailed report by Mandiant reveals that attackers exploited a zero-day flaw (CVE-2026-20245) in Cisco SD-WAN to gain root-level access to a service provider's infrastructure.
The breach involved unauthorized peering connections and manipulation of default passwords, followed by the upload of a malicious CSV file to escalate privileges. The attackers have erased traces of their activity, but the full scale of the impact remains unclear. Administrators are urged to update their systems to fixed versions to prevent further intrusions and monitor for indicators of compromise.
How the story developed
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
11 articles from 5 outlets since 25 Jun. Quiet since 21 Aug. This was the 7th report, 16 hours after the first.
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV. This article, 7th of 11.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 11 articles as a listHide the list
- Thu 25 JunDay 01
- Critical PTC Windchill flaw CVE-2026-12569 under active attack22:21 · CISA · official · First report · CISA alert · Known exploited CVE
- Fri 26 JunDay 16
- Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
- PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
- Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE · This article, 7th of 11
Show 3 more from 26 Jun
- Critical PTC Windchill flaw CVE-2026-12569 under active attack06:19 · CISA · official · Known exploited CVE
- PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-1256908:31 · SecurityWeek · Known exploited CVE
- CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
Quiet for 4 weeks
Fri 24 JulDay 291- Clop ransomware hits Windchill via CVE-2026-12569 flaw12:51 · DataBreaches · Picked up again · Known exploited CVE
Quiet for 3 days
Mon 27 JulDay 321- Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw13:31 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 3 weeks
Wed 19 AugDay 551- Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign11:32 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 2 days
Fri 21 AugDay 571- Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips08:20 · Security Affairs · Known exploited CVE