Unauthenticated RCE Across the Enterprise Stack

Two entries this cycle represent the highest-severity class in the catalog: unauthenticated remote code execution against widely deployed enterprise products. Both deadlines are overdue.

PTC Windchill and FlexPLM (CVE-2026-12569, deadline June 28) affects product lifecycle management platforms used heavily in defense industrial base and manufacturing supply chains. The improper input validation flaw allows an unauthenticated remote attacker to execute arbitrary code via a malicious network request — no credentials, no prior access, no social engineering required. For federal contractors with Windchill instances that process controlled unclassified information (CUI) or export-controlled technical data, exploitation of this vulnerability could constitute a reportable incident under federal acquisition regulations. Organizations should immediately restrict network access to Windchill and FlexPLM interfaces, apply vendor patches, and review access logs from June 25 onward for anomalous unauthenticated requests. If patching is not immediately feasible, consider taking internet-facing instances offline until remediation is complete.

Lantronix EDS5000 (CVE-2025-67038, deadline June 26) introduces risk at the operational technology boundary. This code injection vulnerability allows OS command injection through the username parameter, with injected commands executing at root. EDS5000 devices serve as serial-to-Ethernet device servers, commonly bridging legacy OT equipment to IP networks. Root-level command injection on a device in this position enables persistence, pivoting into adjacent OT or IT network segments, and potential disruption of connected serial devices. If patches are unavailable or the device is end-of-life, network isolation and discontinuation of internet exposure are the required response under BOD 26-04.

Authentication Failure and Collaboration Platform RCE: Act Now

Two entries carry the most recent addition dates and together represent active threat surfaces across collaboration and remote support tooling.

SimpleHelp (CVE-2026-48558, deadline July 2) presents a critical authentication bypass in its OIDC flow. Because submitted identity tokens are accepted without signature verification, a remote unauthenticated attacker can forge arbitrary identity claims and obtain a fully authenticated technician session — and in some configurations, bypass MFA entirely. SimpleHelp is a managed service provider staple, meaning a single compromised instance can cascade into downstream customer environments. This is an MSP supply-chain risk, not just a point vulnerability. Organizations should immediately verify their SimpleHelp version, apply the patch, rotate all technician credentials and API tokens, review session logs for anomalous logins since June 29, and treat any authenticated session established against an unpatched instance as suspect.

Microsoft SharePoint Server (CVE-2026-45659, deadline July 4) carries a deserialization of untrusted data vulnerability enabling network-based code execution by an authorized attacker. While authentication is required, the barrier is low in environments where broad internal access to SharePoint is standard practice. The July 4 deadline — a U.S. federal holiday — created a de facto remediation gap for many organizations. As of today, that deadline is two days past. Apply Microsoft's patch immediately, review SharePoint access logs for unusual deserialization activity, and consider restricting SharePoint to known-good network segments while remediation is confirmed.

Summary Remediation Priorities

| Priority | CVE(s) | Deadline Status | |---|---|---| | Critical — Patch + Forensics Now | CVE-2026-12569, CVE-2025-67038, CVE-2026-48558 | Overdue | | High — Emergency Change | CVE-2026-20230, CVE-2026-34908/09/10 | Overdue | | High — Immediate Patch | CVE-2026-45659 | Overdue (July 4) |

All organizations subject to BOD 26-04 should document remediation actions and retain forensic triage evidence per CISA guidance.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Microsoft Security Update Guide · Cisco Security Advisory: Unified CM SSRF · PTC Security Advisory: Windchill · SimpleHelp Security Releases · Ubiquiti Security Advisory: UniFi OS · Lantronix Product Security