Skip to content
feed: live
>_0dayNews
← All vendors
Vendor

PTC

Coverage of PTC's Product Lifecycle Management and Product Data Management platforms — Windchill PDMLink and FlexPLM — the enterprise engineering software that owns CAD, BOMs, and manufacturing releases at large industrial and defense firms. Not ICS itself, but the pipeline into it.

1 CVEs3 articlesRSS
CVEs
CVE-2026-12569
[ CRITICAL ]CVSS 9.8EPSS 40.6%kev

PTC Windchill PDMLink & FlexPLM unauthenticated RCE via untrusted deserialization

Unauthenticated remote code execution in PTC Windchill PDMLink and FlexPLM via untrusted-data deserialization. Added to CISA KEV 2026-06-25 with a three-day patch mandate. JSP webshells observed being dropped on unpatched instances.

PTC / Windchill PDMLink and FlexPLM (see body for affected version ranges)
Articles
~/articles/2026-08-18-clop-windchill-webshell-credential-theft
Clop's Windchill Implant Decrypts Passwords, Steals Files
ptc

Clop's Windchill Implant Decrypts Passwords, Steals Files

ReliaQuest finds a Clop-linked JSP implant engineered for PTC Windchill that decrypts LDAP credentials and maps file vaults to steal engineering data.

read →
~/articles/2026-07-25-clop-targets-ptc-windchill-flexplm-data-theft
Clop Hits Windchill and FlexPLM in Data-Theft Push
ptc

Clop Hits Windchill and FlexPLM in Data-Theft Push

Clop is running an active data-theft campaign against internet-exposed PTC Windchill and FlexPLM. No encryption — straight to exfiltration and extortion.

read →
~/articles/2026-07-11-ptc-windchill-flexplm-cve-2026-12569-kev-jsp-webshell
PTC Windchill PLM RCE is on KEV — shells still landing
ptc

PTC Windchill PLM RCE is on KEV — shells still landing

PTC Windchill PDMLink and FlexPLM ship an unauth deserialization RCE. CISA added it to KEV on 2026-06-25. Unpatched instances are still catching JSP webshells.

read →