[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNoI5_vvVQJWMb1nlqMRQLc6vj8xpTIxCOAVHxzSa3y4":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"8695442e-b37c-41f4-a0b5-c4fdbad557fd","CISA sets urgent deadline to fix Cisco flaw exploited in attacks","cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks-e646fd","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is giving federal agencies until Sunday to patch a vulnerability in Cisco Unified Communications Manager Server that is being actively exploited. [...]","CISA has issued an urgent directive, Binding Operational Directive (BOD) 26-04, requiring federal agencies to patch two critical vulnerabilities by Sunday, June 28. The first, CVE-2026-20230, is an SSRF flaw in Cisco Unified Communications Manager Server that is already being actively exploited. The second, CVE-2026-12569, is an RCE vulnerability in PTC's Windchill and FlexPLM products, also deemed critical.","CISA mandates federal agencies patch Cisco and PTC flaws by Sunday, June 28.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F01\u002F13\u002FCISA.jpg","2026-06-26T19:43:06+00:00","2026-06-26T20:00:11.452071+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Cisco","vendor",{"name":21,"type":22},"Cisco Unified Communications Manager Server","product",{"name":24,"type":19},"PTC",{"name":26,"type":22},"Windchill",{"name":28,"type":22},"FlexPLM","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,45,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2026-20230","Cisco Unified Communications Manager Server SSRF vulnerability",{"type":54,"value":58,"context":59},"CVE-2026-12569","PTC Windchill and FlexPLM RCE vulnerability",[18,24,21],{"controls":62,"vendors":143},[63,92,117],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":93,"product_name":114,"url":115,"description":116},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,127,135],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":123,"product_name":124,"url":125,"description":126},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"cisco","\u002Fvendor-logos\u002Fcisco.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":163},"active-exploitation-of-cisco-ucm-ssrf-flaw-triggers-cisa-emergency-patching-deadline","Active Exploitation of Cisco UCM SSRF Flaw Triggers CISA Emergency Patching Deadline","Two critical vulnerabilities — an SSRF flaw in Cisco Unified Communications Manager (CVE-2026-20230) and an RCE flaw in PTC Windchill\u002FFlexPLM (CVE-2026-12569) — are being actively exploited, prompting CISA to issue a binding directive requiring federal agencies to patch by June 28. The core failure here is delayed remediation of known, critical vulnerabilities in widely deployed enterprise systems, giving attackers an open window to compromise infrastructure. SSRF flaws can allow attackers to pivot internally and reach otherwise protected systems, while RCE vulnerabilities can lead to full system takeover. This situation underscores the danger of treating patching as routine rather than urgent when active exploitation is confirmed. Organizations that lack a mature vulnerability management program with prioritization based on exploitability are most at risk.",[154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","CISA Binding Operational Directive 22-01: Known Exploited Vulnerabilities Catalog","NIST IR-4: Incident Handling","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Emergency Change Procedures",{}]