Cybersecurity agencies have flagged active exploitation of a critical code injection flaw in Lantronix EDS5000 Series devices, tracked as CVE-2025-67038 with a CVSS score of 9.8. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Federal Civilian Executive Branch agencies to apply fixes by June 26, 2026. Separately, attackers are exploiting a high-severity server-side request forgery vulnerability in Cisco Unified Communications Manager (CVE-2026-20230, CVSS 8.6) following the public release of a proof-of-concept exploit.
CVE-2025-67038 carries a maximum CVSS severity rating of 9.8, indicating it can be remotely exploited without authentication to execute arbitrary code. CISA’s Known Exploited Vulnerabilities catalog includes the flaw, signaling active threat actor use. For the Cisco issue, a PoC became available in early June when Cisco announced patches, and security firms now report real-world attacks leveraging the vulnerability to achieve remote code execution with root privileges on affected systems.
The Lantronix vulnerability stems from improper input validation, allowing attackers to inject malicious code via crafted network requests to devices used in critical infrastructure. In the Cisco case, the SSRF flaw enables an unauthenticated, remote attacker to send specially crafted HTTP requests, potentially leading to file write operations. Indicators of compromise include unexpected HTTP traffic patterns and unauthorized file modifications on Unified CM servers.
CISA has mandated that FCEB agencies patch Lantronix EDS5000 devices within three weeks. Cisco released software updates for CVE-2026-20230 in early June, and the company advises administrators to apply patches immediately. For organizations unable to patch immediately, Cisco recommends network segmentation and access controls to limit exposure of Unified CM systems.
Attribution for either attack chain remains unclear. Mandiant documented one incident at a communications service provider where a Cisco zero-day was exploited for highest-level access, though broad visibility into victim traffic was not confirmed. No single threat group has claimed responsibility for either vulnerability's exploitation.