CRITICALVulnerability
Global

CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue

·Source: The Hacker News

Updated:

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is

Analysis

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability in question is
Source Attribution

Originally published by The Hacker News on Jun 26, 2026.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-9725 — The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress...

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path

CVE-2026-9725
NIST NVD
MEDIUMVulnerability

Spyware found on phone of European Parliament member probing it

Stelios Kouloglou, formerly a member of the European Parliament's committee investigation abuses of commercial spyware, was twice infected with Pegasus while serving, researchers said.

The Record
MEDIUMVulnerability

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name. The post Someone infected a spyware probe overseer with spyware appeared first on CyberScoop .

CyberScoop