CVE digest: Cisco, Ubiquiti, PTC and Lantronix exploited in the wild

Four vulnerabilities are now confirmed exploited, each added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in the week ending June 29, 2026: a command injection in Ubiquiti UniFi OS, a server-side request forgery flaw in Cisco Unified Communications Manager, an OS command injection in the Lantronix EDS5000 serial server, and a deserialization remote code execution in PTC Windchill and FlexPLM. All four are network-reachable and need no authentication. Their EPSS scores run from 78.6% at the top down to 1.1%, which is the gap worth reading carefully: the catalog says all four have been used, the model disagrees on how fast each spreads next.

Three acronyms run through this digest. CVSS scores how damaging a flaw would be if someone exploited it, on a 0 to 10 scale. EPSS estimates the chance it gets exploited in the next 30 days, shown here as a percentage. KEV is CISA’s catalog of flaws with confirmed real-world attacks. Severity and likelihood are not the same thing. The full method is in our CVSS vs EPSS vs KEV breakdown.

What’s now confirmed exploited this week

All four entries below appear in the CISA KEV feed with a dateAdded inside the last seven days, which is the only reason they are in this digest. The CVSS figures are NVD’s base scores; the EPSS values are what FIRST returned on June 29, 2026. KEV membership is a binary fact: CISA lists these as exploited. EPSS is a separate, probabilistic read, and the chart shows how far that read spreads across four flaws CISA treats the same.

Four flaws confirmed exploited, ranked by EPSS

The order below runs by EPSS, highest first. The point of the section is that all four share the same KEV status. The model disagrees on how fast each will spread; CISA does not disagree on whether they have been used.

CVE-2026-34910: Ubiquiti UniFi OS

CVSS base score: 10.0 (Critical). EPSS: 78.6% (99th percentile).

CVE-2026-34910 is an improper-input-validation flaw (CWE-20) in UniFi OS. NVD’s description is short: a malicious actor with access to the network can exploit it to execute a command injection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is a 10.0, the scope-changed, no-auth, no-interaction profile that leaves no room to defer. The affected list is wide: UniFi OS Server before 5.0.8, and the Dream Machine, Dream Router, gateway, NVR and UNAS lines on builds before 5.1.10 to 5.1.12 depending on model. CISA added it to KEV on June 23, 2026. This is the one flaw this week where the severity and the near-term likelihood agree, so a UniFi OS gateway or controller reachable on your network is the first thing to check.

Go deeper: the UniFi OS command-injection chain and the exact builds to patch.

CVE-2026-20230: Cisco Unified Communications Manager

CVSS base score: 8.6 (High). EPSS: 41.7% (98th percentile).

CVE-2026-20230 is a server-side request forgery flaw (CWE-918) in Cisco Unified Communications Manager and the Session Management Edition. Per NVD, an unauthenticated, remote attacker can conduct SSRF attacks through an affected device. CISA’s KEV entry adds that the request handling can be used to write files to the underlying operating system, which an attacker can use later to elevate to root. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) carries a scope change with an integrity-only impact, which is why it lands at 8.6 rather than higher. NVD lists Unified CM and Unified CM SME 14.0 up to before 14SU6, and 15.0 up to and including 15SU4a. CISA added it to KEV on June 25, 2026. A call-control platform that fronts every desk phone is a footprint worth patching on schedule.

Go deeper: how the SSRF reaches the file system on Unified CM and the fixed builds.

CVE-2025-67038: Lantronix EDS5000

CVSS base score: 9.8 (Critical). EPSS: 1.1% (62nd percentile).

CVE-2025-67038 is a code-injection flaw (CWE-94) in the Lantronix EDS5000 device server. NVD describes the HTTP RPC module running a shell command to write a log entry when a user’s authentication fails, with the username concatenated straight into that command without sanitization. An attacker injects OS commands through the username parameter, and those commands run with root privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is network-reachable and needs no credentials, since the injection happens on the failed-login path itself. NVD lists the EDS5032, EDS5008 and EDS5016 on firmware 2.1.0.0R3. CISA added it to KEV on June 23, 2026. The low EPSS here reflects a narrow install base, not low risk on a device that exposes a serial console to a network.

Go deeper: the failed-login command injection on the EDS5000 and the firmware to apply.

CVE-2026-12569: PTC Windchill and FlexPLM

CVSS base score: 9.8 (Critical). EPSS: 1.1% (61st percentile).

CVE-2026-12569 is a remote code execution flaw in PTC Windchill PDMLink and FlexPLM, exploited through deserialization of untrusted data (CWE-502, CWE-20). NVD records a v3.1 base of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a secondary v4.0 base of 9.3. The affected list spans Windchill PDMLink and FlexPLM across the 11.x, 12.x and 13.x trains, including Windchill 13.1.0.0 through 13.1.3.0, so the exact build matters when you scope the patch. CISA added it to KEV on June 25, 2026. Product lifecycle management systems hold engineering and supply-chain data, and an unauthenticated deserialization path into one is the kind of access that does not show up in a perimeter scan.

What to change in your queue this week

The pattern this week is four confirmed-exploited flaws that an EPSS-sorted queue would split in half: UniFi OS reads 78.6% and Cisco Unified CM 41.7%, while Lantronix and PTC both sit at 1.1%. KEV is the signal that keeps all four near the top. Three moves:

1. Filter to what you run, then sort by KEV. A UniFi OS gateway, a Cisco call-control cluster, a PLM server and a Lantronix serial server are four very different footprints. The same KEV status means different work depending on your inventory.
2. Do not let a low EPSS bury a fresh KEV listing. The 1.1% on Lantronix and PTC reflects narrow install bases, not safety. Both are unauthenticated paths to code execution on the affected systems.
3. Re-test all four: every one is reachable over the network without credentials, from the UniFi OS command injection to Cisco’s SSRF. A version bump is not a closed finding until you have confirmed the path is gone.

If you only have time for one this week, start with UniFi OS: it is the single flaw here where a 10.0 severity and a 78.6% EPSS point the same way. Then work Cisco against your voice infrastructure, and PTC and Lantronix against their narrower footprints.