KEV: Lantronix, Ubiquiti UniFi OS, PTC Windchill and FlexPLM, and Cisco Unified Communications Manager
NEOSEC enrichment — no mirror of the original source
The US Cybersecurity and Infrastructure Security Agency (CISA) has added six CVEs to the Known Exploited Vulnerabilities (KEV) database so far this week; all six were assigned three-day mitigation windows. CVE-2025-67038 is a critical code
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Neely.
Linked advisories
- CVE-2026-34908Ubiquiti UniFi OS Server: Mehrere Schwachstellen
- CVE-2026-20230Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-34908ui enterprise_fortress_gateway_firmware: unzureichende Zugriffskontrolle
- CVE-2026-12569PTC FlexPLM: Schwachstelle ermöglicht Codeausführung
- CVE-2026-34909A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system …
- CVE-2025-67038lantronix e213f102s_firmware: Betriebssystem-Befehlsinjektion
- CVE-2026-20230cisco unified_communications_manager: Server-Side-Request-Forgery (SSRF)
- CVE-2026-34909Ubiquiti UniFi OS — Ubiquiti UniFi OS Path Traversal Vulnerability
- CVE-2026-12569PTC Windchill PDMLink: Deserialisierung nicht vertrauenswürdiger Daten
- CVE-2026-34910Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Input Validation Vulnerability
- CVE-2026-34910ui enterprise_fortress_gateway_firmware: unzureichende Eingabevalidierung
- CVE-2026-34908A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
- CVE-2026-34908Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Access Control Vulnerability
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
- CVE-2026-12569PTC Windchill and FlexPLM — PTC Windchill and FlexPLM Improper Input Validation Vulnerability
- CVE-2025-67038Lantronix EDS5000 — Lantronix EDS5000 Code Injection Vulnerability
- CVE-2026-34909Ubiquiti UniFi OS: Pfadüberschreitung (Path Traversal)
- CVE-2026-20230Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Manipulation von Dateien
Affected vendors and products
- Cisco Cisco Unified Communications Manager
- Cisco Cisco Unified Communications Manager
- LANTRONIX Eds5000 Series
- LANTRONIX Lantronix EDS5008 Firmware
- LANTRONIX Lantronix EDS5016 Firmware
- LANTRONIX Lantronix EDS5032 Firmware
- LANTRONIX G520 Series
- LANTRONIX X300 Series
- PTC PTC FlexPLM
- PTC Windchill Pdmlink
- Ubiquiti Unifi OS Server
- Ubiquiti Inc Efg
More on FlexPLM
Other advisories
- CriticalCVE-2026-77646PTC Windchill und FlexPLM: Mehrere Schwachstellen
- CriticalCVE-2026-77645PTC FlexPLM: Deserialisierung nicht vertrauenswürdiger Daten
- CriticalCVE-2026-77645PTC FlexPLM: Deserialisierung nicht vertrauenswürdiger Daten
- CriticalCVE-2026-12569PTC FlexPLM: Schwachstelle ermöglicht Codeausführung
- CriticalCVE-2026-12569PTC Windchill and FlexPLM: PTC Windchill and FlexPLM Improper Input Validation Vulnerability
- CriticalCVE-2026-12569PTC Windchill PDMLink: Deserialisierung nicht vertrauenswürdiger Daten
Other news entries
- PTC Windchill und FlexPLM: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering DataNewsThe Hacker News
- Clop created custom web shell for Windchill data theft attacksNewsBleepingComputer
- Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCENewsThe Hacker News
- Clop ransomware targets Windchill, FlexPLM in data theft attacksNewsBleepingComputer
- Patch Now: Critical PTC Windchill VulnerabilityVulnerabilitySANS NewsBites
- Hackers exploit critical PTC Windchill PLM software flawNewsCSO Online
- CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks ContinueNewsThe Hacker News
ID