CVE-2026-12569 — kevrichment

▼Details

VendorPTC

ProductWindchill and FlexPLM

Vulnerability NamePTC Windchill and FlexPLM Improper Input Validation Vulnerability

Date AddedJun 25, 2026

Due DateJun 28, 2026

Required ActionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-20 CWE-502

PublishedJun 18, 2026

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

▼Descriptions

KEV DescriptionPTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

NVD DescriptionA critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

▼Compliance (SSVC + BOD 26-04)

Automatableyes

Technical Impacttotal

Exploitation Statusactive

3-Day QualifyingYes

Public Timeline3 days forensic triage

Non-Public Timeline3 days forensic triage

Forensic (Public)Required

Forensic (Non-Public)Required

▼Research Metadata

Last Researched2026-07-02 12:00 UTC

Wall Time0.6s

Searches2

Component Defaultunknown

Sourceshttps://nvd.nist.gov/vuln/detail/CVE-2026-12569
https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
https://github.com/west-wind/Threat-Hunting-With-Splunk
https://threat-modeling.com/cve-2026-12569-ptc-windchill-flexplm-rce-cisa-kev/
https://www.sentinelone.com/vulnerability-database/cve-2026-12569/
https://www.penligent.ai/hackinglabs/de/cve-2026-12569/

🎯 Hunting Hypothesis

Monitor for unauthenticated HTTP requests to PTC Windchill or FlexPLM servers carrying serialized payloads targeting deserialization vulnerabilities to achieve remote code execution.

▼Research Details

ComponentPTC Windchill PDMlink / FlexPLM deserialization handler

PreconditionsNetwork reachability to PTC Windchill or FlexPLM server on HTTP/HTTPS ports; no authentication required; vulnerable versions prior to 11.0 M030, all CPS versions affected.

Deliverycrafted HTTP request carrying serialized payload to Windchill/FlexPLM endpoint

Public PoCyes

PoC URLshttps://github.com/west-wind/Threat-Hunting-With-Splunk

Advisoryhttps://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability

Exploit NotesCVSS 9.8 CRITICAL | No auth required | Deserialization of untrusted data (CWE-502) | Actively exploited — added to KEV June 25, 2026 | PTC advisory published with remediation

▼Summary

PTC Windchill PDMlink and FlexPLM contain a critical deserialization vulnerability (CWE-20/502) allowing unauthenticated remote attackers to execute arbitrary code via crafted requests. Actively exploited in the wild. Public PoC available.