CVE-2026-12569: PTC Windchill PDMlink and FlexPLM deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score 9.3 with network reachability, no privileges or user interaction, CISA KEV listing with known ransomware use, and a 98.6th-percentile EPSS score.

What it is

PTC Windchill PDMlink and FlexPLM contain a deserialization of untrusted data flaw (also classified as improper input validation) that allows remote code execution. The advisory notes it also applies to all CPS versions and to Windchill and FlexPLM releases prior to 11.0 M030. It matters because the flaw is network-reachable with no privileges or user interaction, and CISA has added it to KEV with known ransomware campaign use.

Impact

An unauthenticated remote attacker can execute arbitrary code on the affected server, giving full control of the Windchill/FlexPLM host and any data or downstream systems it can reach. CISA's KEV entry records known ransomware campaign use, so impact includes potential data theft and encryption.

Attack surface

Reached over the network via the application's handling of serialized input; the CVSS 4.0 vector shows AV:N, AC:L, PR:N and UI:N, so no authentication or user interaction is required. The PTC reference is tagged 'Permissions Required', which conflicts with the PR:N vector and should be verified against the vendor advisory.

Exploitation

Listed in CISA KEV (added 2026-06-25, due 2026-06-28) with known ransomware campaign use, and EPSS 30-day probability is 0.40586 (98.6th percentile), indicating active exploitation is expected. No public exploit references are included in this record.

What to do

• Apply the vendor fix from PTC advisory CS473270 for Windchill PDMlink, FlexPLM, all CPS versions, and releases prior to 11.0 M030; treat the 2026-06-28 KEV due date as the deadline.
• If patching cannot be completed immediately, follow CISA BOD 26-04 guidance for cloud services or discontinue use of the exposed product.
• Remove direct internet exposure of Windchill/FlexPLM endpoints and restrict access to trusted networks or VPN while remediation is pending.
• Verify the authentication requirement against the vendor advisory, since the PTC reference is tagged 'Permissions Required' while the CVSS vector states PR:N.
• Assume compromise on any host that ran an unpatched version and initiate incident response, given the documented ransomware use.

Detection

• Hunt for unexpected child processes spawned by the Windchill/FlexPLM Java or application server (for example cmd.exe, powershell.exe, /bin/sh, curl, wget).
• Monitor for deserialization-related errors, class-loading anomalies, or unusual serialized payloads in application and web server logs.
• Review network egress from Windchill/FlexPLM hosts for connections to unfamiliar external addresses, which may indicate post-exploitation or ransomware staging.
• Audit file writes and new service or scheduled-task creation on Windchill/FlexPLM servers for signs of persistence or encryption activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.