CVE-2026-12569: PTC Windchill/FlexPLM Deserialization RCE

Checked: 2026-10-29

CVE-2026-12569 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM, product-lifecycle-management software used by manufacturers: an unauthenticated attacker can send a malicious request that triggers deserialization of untrusted data, executing arbitrary code on the server, and CISA's KEV catalog records confirmed ransomware-campaign use of this flaw.

Vulnerability summary

Vulnerability ID	CVE-2026-12569
CVSS score	9.8
EPSS score	0.46049
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2026-06-18T01:18:12.040

Affected components

Component	CPE	Version range
PTC Windchill PDMLink	cpe:2.3:a:ptc:windchill_pdmlink::::::::	All releases before 11.0 M030, plus the specific builds 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0 and 13.1.3.0 (per NVD CPE data; PTC's own advisory CS473270 sits behind a support-portal login and could not be fetched this run, so no vendor-confirmed fixed version is claimed here)
PTC FlexPLM	cpe:2.3:a:ptc:flexplm::::::::	All releases through 11.0 M030, plus the specific builds 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.3.0, 13.0.2.0 and 13.0.3.0 (per NVD CPE data; same vendor-advisory access limitation as above)

What this means

CVE-2026-12569 is a critical remote code execution (RCE) vulnerability in PTC Windchill PDMLink and PTC FlexPLM, reachable through deserialization of untrusted data (CWE-502) combined with improper input validation (CWE-20). Windchill and FlexPLM are product-lifecycle-management (PLM) platforms that manufacturers use to manage CAD data, bills of materials and engineering change records, so a successful RCE against an Internet-reachable instance can expose a manufacturer's engineering intellectual property as well as the server itself. NVD's description notes the advisory "also applies to all CPS versions" and that the vulnerability "also impacts Windchill and FlexPLM releases prior to 11.0 M030" (NVD).

NVD's own analysis gives an NVD Primary (NVD-confirmed) CVSS v3.1 score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. A CVSS v4.0 score of 9.3 (CRITICAL) is also recorded as a Secondary metric (NVD).

CISA added CVE-2026-12569 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25 with an unusually short required-action due date of 2026-06-28 — three days — and the catalog entry marks knownRansomwareCampaignUse as Known and forensicTriage as Yes (catalog version 2026.10.28, confirmed live this run), indicating this flaw has already been used in ransomware intrusions rather than only being theoretically exploitable (CISA KEV catalog).

PTC's own advisory (CS473270) sits behind a customer-support-portal login and returned an HTTP redirect to the login page when fetched this run, so no vendor-specific patch version or workaround beyond what NVD and CISA already state is claimed here; organizations running affected Windchill or FlexPLM builds should consult their PTC support account directly for the fixed release and apply it, and in the interim should not expose Windchill/FlexPLM application servers directly to the Internet.

As of 2026-10-28, FIRST scores the probability of exploitation at 0.46049 (98.804th percentile) — very high, consistent with a critical unauthenticated RCE in widely deployed manufacturing software with confirmed ransomware use (FIRST EPSS). Given the combination of unauthenticated RCE, NVD-confirmed critical severity, and confirmed ransomware campaign use, any Internet-exposed Windchill PDMLink or FlexPLM instance on an affected build should be treated as a priority patch (via PTC support) or taken off the public Internet immediately.

How to fix this class of issueThis advisory's weakness class is Insecure deserialization. Our practical guide covers how to detect, fix, verify and disclose it: How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware.

Evidence

PTC Windchill PDMLink and FlexPLM contain a critical RCE exploitable via deserialization of untrusted data; applies to all CPS versions and releases prior to 11.0 M030. — NVD
CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, an NVD Primary (NVD-confirmed) metric; CVSS v4.0 9.3 recorded as Secondary. — NVD
Added to the CISA KEV catalog on 2026-06-25, due date 2026-06-28 (catalog version 2026.10.28); knownRansomwareCampaignUse is Known and forensicTriage is Yes. — CISA KEV catalog
Affected Windchill PDMLink and FlexPLM builds per NVD's CPE match data, spanning pre-11.0 M030 releases through 13.1.3.0 (PDMLink) and 13.0.3.0 (FlexPLM); PTC's own advisory CS473270 requires a support-portal login and could not be fetched this run. — NVD
EPSS score is 0.46049 (98.804th percentile) as of 2026-10-28. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.