CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand.
If you read nothing else
- If you run a Check Point, Ubiquiti UniFi or SimpleHelp box, confirm it was patched in June. All three were under active attack.
- If you use PTC Windchill for drawings and parts data, patch it and check for web shells. This was its first known in-the-wild attack.
- CMMC Phase 2 was still scheduled for November 10, 2026. Know your SPRS score and what is behind it.
Six things from June. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. A VPN flaw let attackers in without a password
On June 8, Check Point patched CVE-2026-50751, a flaw in its Remote Access VPN and Mobile Access that let an attacker connect without a valid password. Attacks began May 7 and hit "a few dozen" organizations; in one case, Check Point confirmed follow-on activity tied to a Qilin ransomware affiliate. It only affects gateways still using the old IKEv1 protocol with legacy clients and no machine certificate. Source: BleepingComputer, June 8.
CISA added it to the Known Exploited Vulnerabilities list the same day, with a June 11 deadline for federal agencies. Source: Arctic Wolf, June 9.
What this means for you: an attacker who looks like a normal VPN user is very hard to spot.
Do this: if you have a Check Point firewall, ask your IT provider to confirm the June hotfix is on, IKEv1 is off for remote access, and machine certificates are required.
2. Attackers went after the system that holds engineering drawings
PTC Windchill and FlexPLM, product data systems common in manufacturing, had a remote code execution flaw, CVE-2026-12569, that needs no login. PTC began releasing fixes June 17 and warned on June 18 that attackers were planting persistent web shells to run commands and steal data. CISA added it to its exploited list on June 25, the first PTC flaw ever listed there. Source: SecurityWeek, June 26.
What this means for you: for a defense manufacturer, this is often where the drawings and specifications live, which is exactly the data you are required to protect.
Do this: if you or a partner host Windchill or FlexPLM, apply PTC's fix, check the server against PTC's indicators of compromise, and keep it off the open internet.
3. Network gear: rogue admin accounts on UniFi consoles
On June 23, CISA added three UniFi OS flaws (CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910, each rated 10 out of 10) to its exploited list with a three day federal deadline. Chained together, they allow an attacker to take over the device without logging in. Ubiquiti had released fixes on May 21, and users reported rogue administrator accounts named "John Sim" appearing on their consoles. Source: SecurityWeek, June 24.
What this means for you: small offices use this gear everywhere, and a fix released a month earlier did not protect anyone who had not installed it.
Do this: log in to your UniFi console, confirm it is on the current version, and look at the admin list for any account you do not recognize.
4. A remote support tool could hand out technician accounts
SimpleHelp, a remote support tool many IT providers use to manage client PCs, fixed CVE-2026-48558 in late May (versions 5.5.16 and 6.0 RC 2). On servers using OpenID Connect sign-in, an attacker could create a Technician account, skip MFA, and run scripts on every managed computer. Source: Help Net Security, June 16.
CISA added it to the Known Exploited Vulnerabilities list on June 29. Source: CISA KEV catalog.
What this means for you: your IT provider's remote tool can reach every one of your computers at once.
Do this: ask your IT provider, in writing, which remote support tool they use on your PCs and the date it was last patched.
5. Ransomware claims rose again
Breachsense counted 707 victims claimed on ransomware leak sites in June, up 9% from 646 in May. TheGentlemen led with 94, ahead of DeadLock (81) and Qilin (71). Manufacturing had 49 victims, down from 58 in May. These are claims, not confirmed breaches. Source: Breachsense June 2026 report.
What this means for you: the group names change month to month, but the way in does not: exposed VPNs, firewalls and remote tools, like the ones above.
Do this: make sure you have a recent offline backup and that someone has actually restored a file from it this quarter.
6. CMMC: Phase 2 was still on the calendar
As June closed, CMMC Phase 1 had been in effect since November 10, 2025, and Phase 2 was scheduled to take effect on November 10, 2026. (On July 13, after this issue went out, the Department of War suspended Phase 2 pending a 60 day review; see the note at the top.) Source: WilmerHale client alert, July 20.
What this means for you: your SPRS score and annual affirmation are statements the government relies on.
Do this: check that the score you posted in SPRS matches what your System Security Plan actually says is in place.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.