CVE-2026-12569
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
Description
CVE-2026-12569 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM that is exploited through the deserialization of untrusted data. An unauthenticated attacker can send crafted serialized input over the network and have it reconstructed into objects that execute code on the server, without credentials and without any user interaction. Rated CVSS 9.8 (Critical), the flaw affects Windchill and FlexPLM releases prior to 11.0 M030 as well as a long list of later builds up to the 13.x line, and PTC states the advisory applies to all CPS versions. CISA lists CVE-2026-12569 in its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-06-28, and the KEV entry now records known use in ransomware campaigns, which raises this PTC vulnerability from an actively exploited flaw to a documented ransomware entry point. Because Windchill and FlexPLM hold product designs, bills of materials, and supplier data, a compromise threatens the intellectual property core of a manufacturing business.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ptc | flexplm | <= 11.0m030; 11.1m020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.1.3.0; 13.0.2.0; 13.0.3.0 |
| ptc | windchill pdmlink | < 11.0m030; 11.0m030; 11.1m020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0 |
References
- https://www.ptc.com/en/support/article/CS473270(Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when a product receives data but does not verify that it has the properties required to be processed safely — the expected format, type, length, or range. In Windchill PDMLink and FlexPLM the serialized payload reaching the vulnerable endpoint is accepted and processed without validating that its contents are safe to materialise, which is the failure that allows the more specific deserialization weakness to be reached at all.
Learn more: CWE-20 — Improper Input Validation
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application reconstructs objects from serialized data supplied by an untrusted source without sufficient verification that the result will be valid and safe. In PTC Windchill and FlexPLM, attacker-controlled serialized data is deserialized by the application, allowing arbitrary objects to be instantiated and dangerous operations to be triggered during reconstruction, which in a Java-based PLM platform culminates in remote code execution under the identity of the application server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2026-12569 carries a CVSS 3.1 base score of 9.8 (Critical) with every exploitability metric at its worst: remotely exploitable without physical access, easy to exploit with no special conditions needed, no authentication needed, and no user action required. Confidentiality (High): code execution on a Windchill or FlexPLM server exposes CAD models, product structures, bills of materials, supplier agreements, and the database credentials the platform uses. Integrity (High): an attacker can alter product data and workflows, which in a PLM system means corrupting the authoritative record that manufacturing and compliance processes depend on. Availability (High): the same access allows the platform to be disabled, halting engineering and change-management work across the business. The decisive change is the KEV ransomware flag: exploitation of CVE-2026-12569 is now associated with known ransomware campaigns, so the realistic scenario is not quiet data theft but encryption and extortion against a system whose downtime stops production planning. The EPSS score of 2.3% (81st percentile) understates this, since ransomware operators exploit selectively against high-value targets rather than through internet-wide scanning.
Exploit Maturity
CVE-2026-12569 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the KEV entry now marks the vulnerability as known to be used in ransomware campaigns — a change from its earlier status and the single most important signal in this record. No public exploit code is linked in the available references; the sources are PTC support article CS473270, which requires a support login, and the CISA KEV entry. The EPSS score of 2.26% (81.2nd percentile) is moderate and should not be read as reassurance: EPSS estimates broad exploitation probability, while ransomware crews pick targets deliberately, and an unauthenticated deserialization path into a manufacturer's product data platform is exactly the kind of target they select. The remediation deadline of 2026-06-28 has already passed, so any instance still running an affected build is both non-compliant and exposed to a documented extortion campaign.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date of 2026-06-28 has passed, so any unpatched instance is overdue.
- Apply the fix described in PTC support article CS473270 — note that the article requires a PTC support login. Affected Windchill PDMLink builds include all releases before 11.0 M030 plus 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0; affected FlexPLM builds include up to 11.0 M030 plus 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0. PTC states the advisory also applies to all CPS versions, so check the CPS level as well as the base release.
- Remove the Windchill and FlexPLM web tiers from internet exposure and require access through a VPN or an authenticating reverse proxy, since exploitation needs no credentials. Segment the PLM servers from general user networks to limit lateral movement in a ransomware scenario.
- Given the ransomware association, treat unpatched exposed instances as compromised until proven otherwise: review application and web server logs for anomalous POST bodies containing serialized data, check for unexpected processes and scheduled tasks on the application server, verify that backups are offline and restorable, and rotate database and service account credentials.
- As long-term hardening, address both weaknesses: for CWE-502, avoid deserializing untrusted input, prefer text formats such as JSON over binary serialization, enforce HMAC or signature integrity checks on serialized data, and restrict deserialization to an allowlist of expected classes; for CWE-20, apply strict server-side allowlist validation at every trust boundary rather than relying on downstream components to reject malformed input.
Technical Details
The mechanism of CVE-2026-12569 is unsafe deserialization in PTC Windchill PDMLink and FlexPLM: the application accepts serialized data from a network client and reconstructs objects from it without adequately verifying that the resulting object graph is safe (CWE-502), and the absence of validation on that input at the trust boundary is the improper input validation aspect (CWE-20). The two weaknesses describe the same failure at different levels — the missing input check is why untrusted bytes reach the deserializer, and the deserializer is why those bytes become executed code. In Java-based enterprise platforms, an attacker who controls serialized data manipulates it into a gadget chain that instantiates arbitrary objects, sets malicious property values, and triggers dangerous operations during reconstruction, ending in command execution under the application server's identity. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H accounts for the 9.8 score: network delivery (AV:N), no special conditions (AC:L), no privileges (PR:N), no user interaction (UI:N), and full High impact on confidentiality, integrity, and availability. Scope stays unchanged (S:U), though a PLM application server with database and file-vault access provides a broad foothold in the surrounding environment.
Frequently Asked Questions
Is CVE-2026-12569 being actively exploited?
Yes, and the exploitation now includes ransomware. CVE-2026-12569 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-06-28, and the KEV entry records known use in ransomware campaigns. The EPSS score of 2.26% places it in the 81st percentile, which reflects targeted rather than mass exploitation.
What products are affected by CVE-2026-12569?
The vulnerability affects PTC Windchill PDMLink and PTC FlexPLM. For Windchill PDMLink this covers all releases before 11.0 M030 as well as 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, and 13.1.3.0; for FlexPLM it covers releases up to 11.0 M030 plus 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.3.0, 13.0.2.0, and 13.0.3.0, and PTC states the advisory applies to all CPS versions.
How do I fix CVE-2026-12569?
Apply the update described in PTC support article CS473270, which requires a PTC support login, and verify both the base release and the CPS level after patching. Because the flaw is unauthenticated and now linked to ransomware, also remove the Windchill and FlexPLM web tiers from internet exposure, confirm that offline backups are restorable, and review the application server for signs of prior compromise.
How severe is CVE-2026-12569?
CVE-2026-12569 is rated Critical with a CVSS 3.1 base score of 9.8, allowing unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Its inclusion in the CISA KEV catalog with a ransomware flag means the practical severity is at the top of the scale: successful exploitation has led to extortion attacks against the systems that hold a manufacturer's product data.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.