Summary
CVE-2026-12569 is a critical remote code execution vulnerability affecting PTC Windchill PDMlink and FlexPLM. The flaw stems from the deserialization of untrusted data, allowing an attacker to execute arbitrary code remotely without authentication. It impacts releases prior to Windchill and FlexPLM 11.0 M030, including all CPS versions. The vulnerability has been actively exploited in the wild, added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and has been linked to campaigns deploying JSP web shells and, more recently, attacks associated with a Cl0p ransomware affiliate. Organizations using affected versions should apply PTC’s security updates and follow the vendor’s remediation guidance without delay.
Urgent Actions Required
- Apply the latest security updates and follow the remediation guidance provided by PTC immediately.
- Restrict internet exposure of the Windchill login endpoint wherever operationally possible.
- Hunt for compromise using PTC's published indicators of compromise (IoCs), including checking for unauthorized JSP web shells and related malicious activity.
Which Systems Are Vulnerable to CVE-2026-12569?
Technical Overview
- Vulnerability Type: Remote Code Execution (RCE) through Deserialization of Untrusted Data
- Affected Software/Versions:
- PTC Windchill PDMlink releases prior to 11.0 M030, including all CPS versions
- PTC FlexPLM releases prior to 11.0 M030, including all CPS versions
- Additional affected releases include:
- Windchill PDMlink: 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0
- FlexPLM: 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0
- CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-12569 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-12569?
Vulnerability Root Cause:
CVE-2026-12569 is caused by the deserialization of untrusted data in PTC Windchill PDMlink and FlexPLM. Improper input validation allows the applications to process untrusted serialized data, creating an opportunity for an attacker to execute arbitrary code remotely. Because the flaw can be exploited without authentication, a successful attack can result in complete compromise of the affected system.
How Can You Mitigate CVE-2026-12569?
If immediate patching is delayed or not possible:
- Restrict internet access to the Windchill login endpoint wherever operationally feasible.
- Block the identified attacker command-and-control IP address (5.180.41.35) at the network perimeter.
- Configure WAF or IDS rules to block requests containing the X-windchill-req header.
- Search for suspicious POST requests targeting /Windchill/login/*.jsp and inspect systems for unauthorized JSP web shells.
- Use PTC’s published indicators of compromise (IoCs) to perform threat hunting and identify signs of compromise in affected environments.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- PTC Windchill PDMlink deployments running affected versions, including all CPS releases
- PTC FlexPLM deployments running affected versions, including all CPS releases
- Business-Critical Systems at Risk:
- Product Data Management (PDM) systems running PTC Windchill PDMlink
- Product Lifecycle Management (PLM) systems running PTC FlexPLM
- Exposure Level:
- Internet-accessible Windchill and FlexPLM instances are at the highest risk and should be secured immediately
- Organizations in the aerospace, automotive, manufacturing, and retail/apparel sectors have been observed as targets in active exploitation campaigns
Will Patching CVE-2026-12569 Cause Downtime?
Patch application impact: Low. Apply the security updates released by PTC for affected Windchill PDMlink and FlexPLM deployments as soon as possible.
How Can You Detect CVE-2026-12569 Exploitation?
Exploitation Signatures:
Look for HTTP POST requests targeting /Windchill/login/*.jsp, newly created JSP files in the /Windchill/login/ directory matching hexadecimal naming patterns, and requests containing the X-windchill-req header. These behaviors have been associated with active exploitation of CVE-2026-12569.
Indicators of Compromise (IOCs/IOAs):
- HTTP POST requests to /Windchill/login/*.jsp
- Suspicious JSP web shells in /Windchill/login/ with hexadecimal filenames
- Presence of flst.txt in /tmp or the Windchill working directory
- Requests containing the X-windchill-req header
- Connections to the IP addresses published by PTC as part of its IoC list
Remediation & Response
- Remediation Timeline:
- Immediate (0-2 hrs): Apply PTC's security updates or follow the vendor's remediation guidance for affected Windchill and FlexPLM systems.
- Within 24 hrs: Verify that all affected deployments have been updated and check for indicators of compromise (IoCs) published by PTC.
- Incident Response Considerations:
- Search for HTTP POST requests targeting /Windchill/login/*.jsp and inspect systems for suspicious JSP web shells.
- Check for the presence of flst.txt and review logs for requests containing the X-windchill-req header.
- Block known malicious IP addresses published by PTC and investigate any systems showing signs of compromise.
Strengthen NDR With Deception-Driven Detection
-
-
- Learn how deception enhances traditional NDR capabilities
- Reduce false positives with high-fidelity threat alerts
- Detect lateral movement and attacker activity earlier
- Improve SOC efficiency with actionable attack context
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.8 | Indicates a critical remote code execution vulnerability with severe impact and easy exploitability |
| Attack Vector | Network | The vulnerability can be exploited remotely over the network |
| Attack Complexity | Low | Exploitation does not require special conditions or complex attack techniques |
| Privileges Required | None | An attacker does not need to authenticate before attempting exploitation |
| User Interaction | None | No action from a legitimate user is required for a successful attack |
| Scope | Unchanged | The vulnerability impacts the vulnerable application without changing its security authority |
| Confidentiality Impact | High | Successful exploitation can expose sensitive information stored or processed by the affected system |
| Integrity Impact | High | An attacker can execute arbitrary code, allowing unauthorized modification of data or system behavior |
| Availability Impact | High | Exploitation can significantly disrupt or compromise the availability of the affected system |
References:
