Critical Cisco Flaw Exploited in Attacks: CISA Imposes Urgent Deadline for Fixes

CISA Urges Immediate Patching of Critical Cisco Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stern warning to federal agencies, setting a deadline of Sunday for the remediation of a severe vulnerability in Cisco Unified Communications Manager Server that is currently being exploited by malicious actors.

Designated as CVE-2026-20230, the vulnerability is classified as a server-side request forgery (SSRF) and has been added to CISA’s list of Known Exploited Vulnerabilities (KEV).

In accordance with Binding Operational Directive (BOD) 26-04, the urgency of the situation necessitates that the patch be implemented by Sunday, June 28.

Cisco has classified CVE-2026-20230 as critical and released a patch on June 3, cautioning that it could be exploited remotely and without authentication through specially crafted HTTP requests.

While the company initially reported the existence of a proof-of-concept exploit, there was no evidence of active exploitation at the time.

However, recent observations by threat detection startup Defused have confirmed that the vulnerability is actively being exploited to write arbitrary text files to vulnerable endpoints.

The identity of the threat actor behind these attacks remains unknown.

Additional Critical Vulnerability Identified

CISA has also flagged CVE-2026-12569 as a critical flaw in PTC Windchill and FlexPLM software products, affecting product lifecycle management systems developed by PTC for various industries.

CVE-2026-12569 is a severe remote code execution (RCE) vulnerability stemming from improper input validation, allowing exploitation through the deserialization of untrusted data.

PTC disclosed the vulnerability on June 18, urging immediate action from customers to address the issue in vulnerable Windchill and FlexPLM versions.

According to PTC, the vulnerability impacts all versions up to 11.0 as well as multiple versions within the 11.1, 11.2, 12.0, 12.1, and 13.0 release branches.

Similar to the Cisco vulnerability, CISA has set a deadline of June 28 for federal agencies to apply the necessary patches for CVE-2026-12569.

Organizations subject to BOD 26-04 must take prompt action to secure their systems by implementing available security updates and following vendor-recommended mitigations or discontinuing the use of the affected products by the specified deadline.