CVE-2026-20230 & CVE-2026-12569: CISA KEV Alert on Cisco CUCM and PTC Windchill Active Exploitation

---
title: Potential PTC Windchill Exploitation via Web Shell Activity
id: 9a8f7e6d-5c4b-3a2b-1c9d-0e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2026-12569 by identifying the PTC Windchill (typically Java/Tomcat) process spawning cmd.exe or powershell.exe on Windows.
references:
  - https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/25
tags:
  - attack.initial_access
  - attack.t1190
  - cve-2026-12569
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - 'java.exe'
      - 'tomcat'
    ParentImage|contains:
      - 'Windchill'
      - 'FlexPLM'
  filter_legit:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection and filter_legit
falsepositives:
  - Legitimate administrative troubleshooting by PLM administrators (rare)
level: high
---
title: Cisco CUCM SSRF Anomaly - Outbound Connection to Non-Standard Ports
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential SSRF exploitation (CVE-2026-20230) by identifying the CUCM server initiating outbound connections to non-standard internal ports or metadata services.
references:
  - https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/06/25
tags:
  - attack.exfiltration
  - attack.t1071.001
  - cve-2026-20230
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'java'
      - 'Cisco'
    DestinationPort:
      - 80
      - 8080
      - 8000
      - 443
      - 8443
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '127.'
      - '169.254.' # Cloud metadata
  condition: selection
falsepositives:
  - Legitimate internal API calls from CUCM to other cluster nodes or database servers (verify DestinationIp)
level: medium

// Hunt for PTC Windchill exploitation: Java spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "tomcat.exe") 
| where InitiatingProcessFolderPath contains @"Windchill" or InitiatingProcessFolderPath contains @"FlexPLM"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, CommandLine, AccountName
;
// Hunt for Cisco CUCM SSRF: Outbound connections to internal ranges
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DeviceName contains @"CUCM" or InitiatingProcessFileName =~ "java"
| where RemotePort in (80, 443, 8080, 8443, 8000)
| where ipv4_is_in_range(RemoteIP, "10.0.0.0/8") 
   or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") 
   or ipv4_is_in_range(RemoteIP, "172.16.0.0/12")
   or ipv4_is_in_range(RemoteIP, "169.254.0.0/16")
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

-- Hunt for PTC Windchill processes spawning suspicious children on Linux endpoints
SELECT Parent.ProcessName AS ParentName, Parent.CommandLine AS ParentCmd,
       Process.Name, Process.CommandLine, Process.Pid
FROM pslist()
LEFT JOIN pslist() AS Parent ON Process.Ppid = Parent.Pid
WHERE ParentName =~ "java"
  AND (ParentCmd =~ "Windchill" OR ParentCmd =~ "FlexPLM")
  AND Process.Name IN ("/bin/sh", "/bin/bash", "nc", "curl", "wget")

# PowerShell Script: Check for PTC Windchill Service Status and Suggest Review
Write-Host "Checking for PTC Windchill Services..." -ForegroundColor Cyan
$services = Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -like "*Windchill*" -or $_.PathName -like "*Windchill*" -or $_.PathName -like "*FlexPLM*" }

if ($services) {
    foreach ($svc in $services) {
        Write-Host "[+] Found Service: $($svc.Name) - State: $($svc.State)" -ForegroundColor Yellow
        Write-Host "    Path: $($svc.PathName)"
    }
    Write-Host "ACTION REQUIRED: Review the installed Windchill/FlexPLM version against PTC Security Advisory for CVE-2026-12569." -ForegroundColor Red
} else {
    Write-Host "No PTC Windchill services found via WMI." -ForegroundColor Green
}

#!/bin/bash
# Bash Script: Check Cisco CUCM for active Java processes (Service health check)
echo "Checking for Cisco CUCM Process Activity..."
# CUCM typically runs specific Java processes. This checks for Java making outbound connections (SSRF Indication)
netstat -antp 2>/dev/null | grep java | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort -u > /tmp/cucm_outbound.txt

echo "Outbound connections from CUCM Java processes:"
cat /tmp/cucm_outbound.txt

echo "ACTION REQUIRED: Review Cisco Advisory for CVE-2026-20230 and apply patches immediately."