CVE-2026-12569

Imagine your business software has a “data intake” feature that trusts information it receives from the network. This vulnerability is like a trapdoor: a bad actor can send carefully crafted requests and cause the server to run their code instead of just processing the request. Real attackers have already been using this issue, including by placing web shells for ongoing access.

This matters if your business runs PTC Windchill PDMlink or PTC FlexPLM, especially if the service is reachable from the network. The vulnerability does not require a login and does not require user action, so exposure is the key risk. Because real-world exploitation is confirmed via CISA KEV, treat any internet-reachable installation as at risk until proven otherwise.

This is RED because attackers are already exploiting CVE-2026-12569 in the wild, and CISA added it to the KEV catalog. With unauthenticated remote code execution and reports of web shell deployment, delays materially increase the chance of a full compromise and persistence. CISA’s KEV remediation due date is 2026-06-28.

1. Inventory and confirm exposure

   • Identify whether you use PTC Windchill PDMlink and/or PTC FlexPLM.
   • Record the exact Windchill PDMlink version you’re running.
   • Determine whether the affected service is reachable from the internet (directly or via any exposed reverse proxy/load balancer). If you cannot confirm reachability, assume worst case until proven otherwise.

2. Check against the fixed version

   • Windchill PDMlink: the fix is available in 11.0m030.
   • If your Windchill PDMlink version is earlier than 11.0m030, you are expected to be vulnerable and should upgrade.

3. Upgrade (preferred remediation)

   • Plan an upgrade to Windchill PDMlink 11.0m030 or later.
   • Follow your vendor’s release notes for any operational changes required by the upgrade.

4. If you cannot upgrade immediately: apply mitigations and reduce reachability

   • Apply the vendor’s mitigations for CVE-2026-12569.
   • Per CISA KEV guidance, evaluate your internet exposure of each asset and ensure compliance with patching guidance (and for cloud services, follow BOD 26-04 guidance).
   • If mitigations are unavailable, CISA guidance indicates discontinuing use of the product.

5. Post-mitigation/patch verification (especially for web shells)

   • Because reports describe JSP web shell deployments, perform compromise checks aligned to your environment, such as:
     • Look for unexpected web-accessible files/scripts added around the exploitation window.
     • Check for suspicious process launches and persistence mechanisms (e.g., scheduled tasks/services) consistent with web shell behavior.
     • Review application and web server logs for anomalous requests targeting the vulnerable handling path.

6. Timing

   • CISA KEV due date: 2026-06-28. Prioritize actions immediately to meet this deadline.

Severity and type: Critical unauthenticated remote code execution (RCE) in PTC Windchill PDMlink and PTC FlexPLM.

Mechanism: unsafe deserialization of untrusted data (CWE-20, CWE-502), triggered via specially crafted network requests; no authentication and no user interaction required.

Exploitation status: Confirmed real-world exploitation and listed in CISA KEV (added 2026-06-25). News reports describe threat actors deploying JSP web shells against vulnerable systems.

Exploit availability: No public exploit code is on record (per provided findings), but exploitation is still active in the wild.

KEV meaning here: CISA’s Known Exploited Vulnerabilities catalog indicates the issue is being exploited in real environments, which elevates urgency beyond prediction.

EPSS: 0.9% with a flat trend was provided, but KEV/news-confirmed exploitation takes precedence over prediction for prioritization.

Fixed version: Windchill PDMlink is fixed in 11.0m030 (and prior releases are implicated per the advisory backstop).