DirtyClone exploits a metadata propagation failure in the Linux kernel’s networking code. When the kernel copies a network packet internally using the helper function __pskb_copy_fclone(), two helper functions fail to propagate a safety flag called SKBFL_SHARED_FRAG. This flag marks packet memory as shared with a file stored on disk. When the flag is missing, downstream subsystems that perform in-place cryptographic operations, specifically IPsec via the XFRM subsystem, do not trigger the required Copy-on-Write before modifying the memory. They write directly into the page cache copy of the file.

An attacker exploiting this performs the following sequence: load a privileged setuid binary such as /usr/bin/su into memory, wire those memory pages into a network packet, force the kernel to clone the packet using __pskb_copy_fclone(), and route the cloned packet through an IPsec tunnel the attacker controls. The IPsec decryption step overwrites the binary’s login checks with attacker-chosen bytes. The attacker then calls su, which executes the modified in-memory version, now without authentication checks, and receives a root shell. The entire attack modifies the page cache, not the file on disk, so file integrity monitoring tools that check disk hashes report nothing unusual.

The attack requires CAP_NET_ADMIN capability to configure the IPsec tunnel. On most modern Linux distributions with unprivileged user namespaces enabled, any local user can obtain a namespace-local CAP_NET_ADMIN capability without elevated privileges. JFrog confirmed successful exploitation against default installations of Debian, Fedora, and Ubuntu. Ubuntu 24.04 and later, with AppArmor restricting namespace creation by default, is not directly vulnerable in its stock configuration.

The fix, merged to mainline Linux on May 21 as commit 48f6a5356a33 and assigned CVE-2026-43503, ensures the SKBFL_SHARED_FRAG flag is correctly propagated through __pskb_copy_fclone() and skb_shift() and additional fragment-transfer helpers. The fix was backported to stable and LTS kernel branches and is available in distribution kernel packages from Debian, Ubuntu, Fedora, Red Hat, and SUSE.

PTC updated its Trust Center advisory on June 25, 2026, confirming continued reports of heightened threat activity against CVE-2026-12569 in PTC Windchill PDMLink and FlexPLM. The vulnerability is an improper input validation flaw that can be exploited through deserialization of untrusted data by an unauthenticated attacker who can reach the Windchill server over the network. PTC rated the flaw at CVSS 9.3 and released patches for affected versions in the preceding week.

CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog on June 26, making it the first PTC product vulnerability to reach the catalog. Attackers exploiting the flaw are deploying JSP webshells to the Windchill application server. The webshells use filenames consisting of 16 lowercase hexadecimal characters, a technique that prevents simple signature-based detection based on specific filenames. Post-exploitation activity observed by PTC includes file listing operations, indicated by the creation of a file named flst.txt. The attacker command and control protocol uses a custom HTTP header named X-windchill-req, which has no legitimate purpose in the Windchill application.

PTC Windchill PDMLink is a product lifecycle management platform used across the aerospace, defense, manufacturing, automotive, and industrial engineering sectors. It manages product design data, engineering specifications, bill of materials information, and manufacturing processes. The software is widely deployed in organizations that maintain sensitive proprietary designs and production intellectual property.

CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog on June 25, 2026, with a mandatory remediation deadline of June 28 for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. The vulnerability, an unauthenticated server-side request forgery in the Cisco Unified CM WebDialer component that chains into arbitrary file write and ultimately root privilege escalation, was confirmed as actively exploited on June 24 when Defused reported honeypot exploitation activity. SSD Secure published a full technical write-up the same day showing how the WebDialer component’s handling of file:// URIs enables the attack.

Cisco has not confirmed the identity or objectives of the threat actors exploiting this vulnerability. The exploitation pattern observed on honeypots involves scanning for vulnerable instances by writing a test file to /tmp/cve-2026-20230-test.txt, which Cisco and Defused have both flagged as an indicator of compromise. The flaw only affects instances where the WebDialer service is running, and it ships disabled by default. Organizations that have confirmed WebDialer is disabled have no direct exposure to this specific vulnerability.