CVE-2026-12569

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-12569 9.8

PTC · Windchill and FlexPLM · Added 2026-06-25 · Published 2026-06-18

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityPTC Windchill and FlexPLM Improper Input Validation Vulnerability

VendorPTC

ProductWindchill and FlexPLM

Date added2026-06-25

Due date2026-06-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-20 CWE-502

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

NVD: A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-26 01:42 UTC

Wall time0.6s

Searches2

Component defaultunknown

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-12569
https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
https://github.com/west-wind/Threat-Hunting-With-Splunk
https://threat-modeling.com/cve-2026-12569-ptc-windchill-flexplm-rce-cisa-kev/
https://www.sentinelone.com/vulnerability-database/cve-2026-12569/
https://www.penligent.ai/hackinglabs/de/cve-2026-12569/

Hunting hypothesis agent

Hunt Windchill access and WAF logs for POST to DoUploadToCache with serialized Java markers (javax.script.ScriptEngine, xalan.xsltc.trax.templatesimpl); alert on JSP creation under /Windchill/login/ and X-windchill-req header in traffic.

Research details

ComponentWindchill DoUploadToCache / UploadInChunks deserialization handler

PreconditionsNetwork reachability to PTC Windchill PDMlink or FlexPLM server on HTTP/HTTPS ports; no authentication required; vulnerable versions include all Windchill/FlexPLM releases prior to 11.0 M030 and all CPS versions; Java deserialization endpoint accessible. agent

Deliverycrafted HTTP request with serialized Java object payload sent to DoUploadToCache or UploadInChunks endpoint, often paired with X-windchill-req header

Public PoCyes

PoC URLs https://github.com/west-wind/Threat-Hunting-With-Splunk Third-party repos; verify before use.

Advisoryhttps://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability

Exploit notesCVSS 9.8 CRITICAL | No auth required | Deserialization of untrusted data (CWE-502) via DoUploadToCache/UploadInChunks endpoint | Public detection tooling (Splunk queries) shows exploit indicators: serialized Java objects with javax.script.ScriptEngine, java.util.Base64, xalan.xsltc.trax.templatesimpl markers | JSP webshell dropped at /Windchill/login/*.jsp | X-windchill-req header in exploit traffic | Actively exploited, added to KEV June 25, 2026

SummaryPTC Windchill PDMlink and FlexPLM contain a critical deserialization vulnerability (CWE-20/502) in the DoUploadToCache/UploadInChunks endpoint allowing unauthenticated remote attackers to execute arbitrary code via crafted serialized Java payloads. Exploitation drops JSP webshells and uses the X-windchill-req header. Public detection queries published. Actively exploited in the wild.

Tia coverage

First reported2026-06-18

First exploit report2026-06-26

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cl0p-ransomware-windchill-flexplm-campaign-new-details-from-reli clop-created-custom-web-shell-for-windchill-data-theft-attacks clop-group-claims-massive-data-heist-from-shell-philips-ge-via-p first-ever-exploitation-of-ptc-windchill-vulnerability-cve-2026 shell-investigates-potential-incident-after-clop-data-theft-clai

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.