{"id":"CVE-2026-12569","kind":"vulnerability","aliases":["CVE-2026-12569"],"related":[],"title":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM","description":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"PTC Windchill and FlexPLM have an improper input validation flaw that lets an unauthenticated remote attacker run arbitrary code by sending a malicious request over the network. CISA lists it as actively exploited, and the KEV entry notes ransomware use.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-06-25T00:00:00+00:00","products":[{"name":"PTC Windchill and FlexPLM","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"<= 11.0m030","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 11.1m020","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 11.2.1.0","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 12.0.0.0","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 12.0.2.0","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 12.1.3.0","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 13.0.2.0","ecosystem":"vendor"},{"name":"ptc flexplm","fixed":[],"affected":"= 13.0.3.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":["11.0m030"],"affected":"< 11.0m030","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 11.0m030","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 11.1m020","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 11.2.1.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 12.0.2.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 12.1.2.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 13.0.2.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 13.1.0.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 13.1.1.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 13.1.2.0","ecosystem":"vendor"},{"name":"ptc windchill pdmlink","fixed":[],"affected":"= 13.1.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise-plm","exploited","flexplm","on-prem","ptc-windchill","ransomware","vendor"],"not_affected_if":["no-windchill-or-flexplm-deployed"],"how_to_check":"Identify any Windchill or FlexPLM servers reachable from the internet or untrusted networks, and record their installed versions.","fix":"Apply the mitigations and patches from PTC's vendor advisory, as directed by CISA BOD 26-04; if no mitigation exists, take the product offline.","status":"open","published_at":"2026-06-18T01:18:12+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:47+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:33:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patches from PTC's vendor advisory, as directed by CISA BOD 26-04; if no mitigation exists, take the product offline.\nunknown","summary":"PTC Windchill and FlexPLM have an improper input validation flaw that lets an unauthenticated remote attacker run arbitrary code by sending a malicious request over the network. CISA lists it as actively exploited, and the KEV entry notes ransomware use.","category":"vendor","who_cares":["ptc-windchill","flexplm","on-prem","enterprise-plm"],"confidence":0.6,"analyst_note":"Get affected and fixed version ranges and the PTC advisory link from PTC or the CISA KEV entry; sources here give no versions or check steps.","how_to_check":"Identify any Windchill or FlexPLM servers reachable from the internet or untrusted networks, and record their installed versions.\nunknown","needs_analyst":true,"not_affected_if":["no-windchill-or-flexplm-deployed"],"severity_if_unknown":"critical"},"cost_usd":0.000406,"input_tokens":2226,"output_tokens":367,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':174C,200C,231C '-12569':20A,23A '-2026':19A,22A '26':173C,199C,230C 'accord':163C 'action':159C 'activ':121B 'adher':227C 'allow':140C 'and':26A 'appli':160C 'applic':197C 'arbitrari':107B,147C 'asset':221C 'attack':105B,144C 'base':178C 'bod':172C,198C,229C 'cisa':117B,157C,170C,187C 'cloud':203C 'code':4A,108B,148C 'complianc':168C 'contain':134C 'critic':2A 'cve':18A,21A 'discontinu':206C 'ensur':167C,226C 'enterpris':78B 'enterprise-plm':77B 'entri':126B 'evalu':219C 'execut':5A,146C 'exploit':80B,122B 'exposur':224C 'flaw':99B 'flexplm':17A,27A,29A,31A,33A,35A,37A,39A,41A,43A,81B,93B,133C 'follow':196C 'forens':189C 'guidanc':185C,201C 'guidelin':233C 'improp':96B,136C 'input':97B,137C 'instruct':166C 'internet':223C 'kev':125B 'let':101B 'list':118B 'malici':112B,152C 'mitig':161C,212C 'network':116B,156C 'note':127B,184C,195C 'on-prem':82B 'patch':232C 'pdmlink':14A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A 'plm':79B 'prem':84B 'priorit':175C 'product':210C 'ptc':12A,16A,24A,28A,30A,32A,34A,36A,38A,40A,42A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,86B,90B,130C 'ptc-windchil':85B 'ransomwar':88B,128B 'rce':6A 'remot':3A,104B,143C 'report':10A 'request':113B,153C 'requir':158C,191C 'respons':217C 'risk':180C 'run':106B 'secur':176C 'see':181C,192C 'send':110B,150C 'servic':204C 'stakehold':215C 'triag':190C 'unauthent':103B,142C 'unavail':214C 'updat':177C 'url':182C,193C 'use':129B,207C 'valid':98B,138C 'vendor':89B,165C 'vulner':7A,139C 'windchil':13A,87B,91B,131C 'windchill':25A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-18T01:18:12+00:00","kev":{"dateAdded":"2026-06-25","dueDate":"2026-06-28","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:Red","cvss_by":"0b655efc-079c-4cb9-9e8d-164871239f4e","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-12569","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-12569","severity":null,"published_at":"2026-06-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-12569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12569","severity":null,"published_at":"2026-06-18T01:18:12+00:00","modified_at":"2026-08-01T05:16:55+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}