CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV Catalog

Two high-severity vulnerabilities were added to CISA's KEV catalog on June 25, 2026 with evidence of active exploitation: CVE-2026-20230 (an SSRF in Cisco Unified Communications Manager WebDialer that can lead to file writes and root escalation) and CVE-2026-12569 (a deserialization RCE in PTC Windchill and FlexPLM). CISA set a June 28, 2026 remediation deadline; vendors provide fixes (upgrade Cisco to 14SU6/15SU5 or apply interim COP and/or disable WebDialer; upgrade PTC to 11.0 M030) and immediate patching/mitigation is strongly recommended.