Skip to content

PTC Windchill / FlexPLM CVE-2026-12569 exploitation

Summary

CVE-2026-12569 is a critical unauthenticated remote-code-execution vulnerability affecting PTC Windchill PDMLink and PTC FlexPLM. CISA added the flaw to the Known Exploited Vulnerabilities catalog on June 25, 2026, citing known exploitation and a June 28, 2026 remediation due date for covered agencies.

The public CVE/NVD record describes the bug as deserialization of untrusted data. CISA describes the impact as improper input validation that allows an unauthenticated remote attacker to execute arbitrary code by sending a malicious network request. PTC assigned CVSS 4.0 base score 9.3.

Tags

Why this matters

  • Windchill and FlexPLM commonly sit near engineering, product lifecycle, manufacturing, supplier, and intellectual-property workflows; compromise can expose sensitive design and operational data.
  • The vulnerability is unauthenticated and network-reachable according to CISA, making internet-facing, partner-facing, or broadly reachable deployments high priority.
  • CISA's KEV addition converts the issue from theoretical RCE to active-exploitation risk; patching should be paired with exploitation review.
  • Deserialization RCE against enterprise Java-style applications often leaves limited user-facing evidence, so responders should preserve and inspect application, web, identity, and operating-system telemetry.

Public vulnerability detail

  • Affected products: PTC Windchill PDMLink and PTC FlexPLM.
  • Vulnerability class: untrusted-data deserialization / improper input validation (CWE-502, CWE-20).
  • Access requirement: unauthenticated remote network request, per CISA.
  • Impact: arbitrary code execution.
  • Severity: PTC CVSS 4.0 base score 9.3 critical, per NVD's CNA-supplied metric.
  • Known exploitation: CISA KEV date added 2026-06-25; known ransomware use listed as unknown.

NVD's affected-version data lists Windchill PDMLink versions through and including 11.0 M030, plus 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0 as affected. For FlexPLM, NVD lists versions through and including 11.0 M030, plus 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0 as affected. Use PTC's advisory as the source of truth for exact supported-branch fixes and CPS guidance.

Defender heuristics

  1. Inventory Windchill PDMLink and FlexPLM instances, especially systems reachable from the internet, suppliers, partner VPNs, manufacturing networks, or broad internal segments.
  2. Apply PTC mitigations or fixed releases on an emergency timeline; CISA's KEV due date is June 28, 2026.
  3. Before cleanup where feasible, preserve web access logs, application logs, reverse-proxy/WAF logs, SSO/authentication logs, JVM/service logs, filesystem timestamps, and recent deployment artifacts.
  4. Hunt for unusual unauthenticated requests, serialized-object or binary-looking payloads, abnormal HTTP methods or content types, request bursts followed by new processes, and outbound network connections from the application server.
  5. Inspect application servers for newly written web artifacts, modified application files, unexpected scheduled jobs/services, suspicious child processes from the application runtime, and new administrative users or integration tokens.
  6. Rotate credentials reachable from the application host after containment, including database credentials, LDAP/bind accounts, service-account keys, API tokens, and secrets in application configuration.
  7. If exploit traffic or suspicious post-exploitation is present, treat patching as containment only; rebuild or vendor-validate the host before returning it to production trust.

Sources

  • CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • PTC advisory: https://www.ptc.com/en/support/article/CS473270
  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12569