CISA Alerts on Active Exploitation of PTC Windchill and Lantronix EDS5000 Flaws

Thehackernews

CISA Alerts on Active Exploitation of PTC Windchill and Lantronix EDS5000 Flaws

First seen 26 Jun 2026, 13:53 UTC • •69.9

Article Content

1 / 3

Browse articles

ThreatCluster •June 27, 2026 at 11:26 UTC

•CISA added PTC Windchill RCE flaw (CVE-2026-1234) to its KEV list due to active exploitation.
•Lantronix EDS5000 flaw (CVE-2026-5678) is also being actively exploited, affecting networked devices.
•Organizations are advised to implement patches and strengthen security measures immediately.

The Cybersecurity and Infrastructure Security Agency (CISA) has added the PTC Windchill RCE vulnerability (CVE-2026-1234) to its Known Exploited Vulnerabilities (KEV) list due to ongoing web shell attacks. This flaw affects multiple versions of PTC Windchill and allows remote code execution, posing a significant risk to organizations using the software. Concurrently, CISA issued a warning regarding the critical Lantronix EDS5000 flaw (CVE-2026-5678), which is also being actively exploited. The EDS5000 vulnerability impacts networked devices and could lead to unauthorized access and control. Both vulnerabilities are part of a broader trend of increasing exploitation of critical infrastructure vulnerabilities. Organizations are urged to apply patches and enhance their security measures to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 135d ago How this analysis works

Timeline

2026-06-24

CISA warns of critical Lantronix EDS5000 flaw exploitation

CISA confirmed active exploitation of the Lantronix EDS5000 vulnerability, affecting networked devices and allowing unauthorized access.

2026-06-26

CISA adds PTC Windchill RCE flaw to KEV list

CISA included the PTC Windchill RCE vulnerability in its KEV list due to ongoing web shell attacks, affecting multiple versions of the software.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1505.003 - Web Shell

Organization (1)

Lantronix

Affected Platform (1)

Lantronix Eds5000

Relationships

Malware targets Lantronix Eds5000
T1505.003 - Web Shell targets Lantronix Eds5000
Malware related to Lantronix

Following this threat?

Track Lantronix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

CVE-2026-121392 in FreeRDP Exposes RDP Sessions to Interception A vulnerability, CVE-2026-121392, has been identified in FreeRDP versions prior to 3.32.2, which allows man-in-the-middle attackers to bypass server identity checks. The flaw arises from improper certificate validation in the tls_verify_certificate() function, permitting attackers with a trusted certificate to…