ZeroDay Findings
Sign inSign up

Findings

CVE-2026-12569

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Published Jun 17, 2026 · updated Jul 31, 2026 · PTC Windchill and FlexPLM

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Timeline

Detection, updates, and resolution for this record.

  1. Jun 17, 2026 · Catalog

    Detected

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

  2. Jun 25, 2026 · CISA KEV

    Known exploited

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  3. Jun 28, 2026 · CISA KEV

    Remediation due

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

  4. Jul 31, 2026 · Catalog

    Updated

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date Jun 28, 2026

Affected

  • cpe ptc/flexplmversion unspecified
  • cpe ptc/flexplm11.1m020
  • cpe ptc/flexplm11.2.1.0
  • cpe ptc/flexplm12.0.0.0
  • cpe ptc/flexplm12.0.2.0
  • cpe ptc/flexplm12.1.3.0
  • cpe ptc/flexplm13.0.2.0
  • cpe ptc/flexplm13.0.3.0
  • cpe ptc/windchill pdmlinkversion unspecified
  • vendor PTC Windchill and FlexPLMversion unspecified

Sources

  • CISA KEVCVE-2026-12569

    PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.

    cisa.gov
  • CVE.orgCVE-2026-12569

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-12569

    30-day exploitation probability 46.0%

    first.org
  • NIST NVDCVE-2026-12569

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability

    nvd.nist.gov

References