# Newly exploited vulnerabilities: week of 22 to 28 June 2026 (week 26)

Source: https://junglewise.ai/threats/exploited/2026-06-22  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-06-22.json  
License: CC BY 4.0 with a link back

In the week of 22 to 28 June 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Ubiquiti Enterprise Fortress Gateway (3), followed by Ubiquiti UniFi Dream Machine Pro (3) and Ubiquiti UniFi Dream Machine Pro Max (3).

## Newly exploited this week

- [CVE-2026-12569: PTC Windchill and FlexPLM remote code execution via deserialization](https://junglewise.ai/threats/cve-2026-12569-ptc-windchill-and-flexplm-remote-code-execution-via) (critical, exploited in the wild, CVSS 9.3, exploited since 25 Jun 2026, published 18 Jun 2026)
- [CVE-2026-20230: Cisco Unified Communications Manager SSRF in WebDialer](https://junglewise.ai/threats/cve-2026-20230-cisco-unified-communications-manager-ssrf-in-webdialer) (critical, exploited in the wild, CVSS 8.6, exploited since 25 Jun 2026, published 3 Jun 2026)
- [CVE-2026-34910: Ubiquiti UniFi OS command injection via improper input validation](https://junglewise.ai/threats/cve-2026-34910-ubiquiti-unifi-os-command-injection-via-improper-input-validation) (critical, exploited in the wild, CVSS 10, exploited since 23 Jun 2026, published 22 May 2026)
- [CVE-2026-34909: Ubiquiti UniFi OS path traversal in underlying system files](https://junglewise.ai/threats/cve-2026-34909-ubiquiti-unifi-os-path-traversal-in-underlying-system-files) (critical, exploited in the wild, CVSS 10, exploited since 23 Jun 2026, published 22 May 2026)
- [CVE-2026-34908: Ubiquiti UniFi OS improper access control](https://junglewise.ai/threats/cve-2026-34908-ubiquiti-unifi-os-improper-access-control) (critical, exploited in the wild, CVSS 10, exploited since 23 Jun 2026, published 22 May 2026)
- [CVE-2025-67038: Lantronix EDS5000 OS command injection in HTTP RPC module](https://junglewise.ai/threats/cve-2025-67038-lantronix-eds5000-os-command-injection-in-http-rpc-module) (critical, exploited in the wild, CVSS 9.8, exploited since 23 Jun 2026, published 11 Mar 2026)

## Technologies hit most

1. [Ubiquiti Enterprise Fortress Gateway](https://junglewise.ai/threats/technologies/efg): 3 vulnerabilities
2. [Ubiquiti UniFi Dream Machine Pro](https://junglewise.ai/threats/technologies/udm-pro): 3 vulnerabilities
3. [Ubiquiti UniFi Dream Machine Pro Max](https://junglewise.ai/threats/technologies/udm-pro-max): 3 vulnerabilities
4. [Ubiquiti UniFi Dream Machine Special Edition](https://junglewise.ai/threats/technologies/udm-se): 3 vulnerabilities
5. [Ubiquiti UniFi Dream Router 5G](https://junglewise.ai/threats/technologies/udr-5g): 3 vulnerabilities
6. [Ubiquiti UniFi Dream Router 7](https://junglewise.ai/threats/technologies/udr7): 3 vulnerabilities
7. [Ubiquiti UniFi Dream Wall](https://junglewise.ai/threats/technologies/udw): 3 vulnerabilities
8. [Ubiquiti UniFi OS](https://junglewise.ai/threats/technologies/unifi-os): 3 vulnerabilities
9. [free5GC Udm](https://junglewise.ai/threats/technologies/udm): 2 vulnerabilities
10. [free5GC Udr](https://junglewise.ai/threats/technologies/udr): 2 vulnerabilities
11. [Cisco Unified Communications Manager](https://junglewise.ai/threats/technologies/unified-communications-manager): 1 vulnerability
12. Cisco Unified Communications Manager Session Management Edition: 1 vulnerability
13. Lantronix Eds5000: 1 vulnerability
14. [Lantronix EDS5000 firmware](https://junglewise.ai/threats/technologies/eds5000-firmware): 1 vulnerability
15. Lantronix EDS5000 series firmware: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 22 to 28 June 2026 (week 26)", https://junglewise.ai/threats/exploited/2026-06-22, 2 October 2026.