CISA Alerts on Active Exploitation of PTC Windchill and Lantronix EDS5000 Flaws

Thehackernews

CISA Alerts on Active Exploitation of PTC Windchill and Lantronix EDS5000 Flaws

First seen 26 Jun 2026, 13:53 UTC • •69.9

Article Content

1 / 3

Browse articles

ThreatCluster •June 27, 2026 at 11:26 UTC

•CISA added PTC Windchill RCE flaw (CVE-2026-1234) to its KEV list due to active exploitation.
•Lantronix EDS5000 flaw (CVE-2026-5678) is also being actively exploited, affecting networked devices.
•Organizations are advised to implement patches and strengthen security measures immediately.

The Cybersecurity and Infrastructure Security Agency (CISA) has added the PTC Windchill RCE vulnerability (CVE-2026-1234) to its Known Exploited Vulnerabilities (KEV) list due to ongoing web shell attacks. This flaw affects multiple versions of PTC Windchill and allows remote code execution, posing a significant risk to organizations using the software. Concurrently, CISA issued a warning regarding the critical Lantronix EDS5000 flaw (CVE-2026-5678), which is also being actively exploited. The EDS5000 vulnerability impacts networked devices and could lead to unauthorized access and control. Both vulnerabilities are part of a broader trend of increasing exploitation of critical infrastructure vulnerabilities. Organizations are urged to apply patches and enhance their security measures to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 90d ago How this analysis works

Timeline

2026-06-24

CISA warns of critical Lantronix EDS5000 flaw exploitation

CISA confirmed active exploitation of the Lantronix EDS5000 vulnerability, affecting networked devices and allowing unauthorized access.

2026-06-26

CISA adds PTC Windchill RCE flaw to KEV list

CISA included the PTC Windchill RCE vulnerability in its KEV list due to ongoing web shell attacks, affecting multiple versions of the software.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1505.003 - Web Shell

Organization (1)

Lantronix

Affected Platform (1)

Lantronix Eds5000

Relationships

Malware targets Lantronix Eds5000
T1505.003 - Web Shell targets Lantronix Eds5000
Malware related to Lantronix

Following this threat?

Track Lantronix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…

Massive Network of AI Proxy Servers Used for Malicious Activities Uncovered Security researchers from Team Cymru have identified over 10,000 proxy servers in China facilitating malicious AI activities. These servers, termed 'transfer stations,' are primarily used to bypass geographic restrictions and conduct model distillation attacks against frontier AI models. The infrastructure allows…