Vendor

PTC

Coverage of PTC's Product Lifecycle Management and Product Data Management platforms — Windchill PDMLink and FlexPLM — the enterprise engineering software that owns CAD, BOMs, and manufacturing releases at large industrial and defense firms. Not ICS itself, but the pipeline into it.

CVEs

CVE-2026-12569

[ CRITICAL ] CVSS 9.8 EPSS 1.2% kev

PTC Windchill PDMLink & FlexPLM unauthenticated RCE via untrusted deserialization

Unauthenticated remote code execution in PTC Windchill PDMLink and FlexPLM via untrusted-data deserialization. Added to CISA KEV 2026-06-25 with a three-day patch mandate. JSP webshells observed being dropped on unpatched instances.

PTC / Windchill PDMLink and FlexPLM (see body for affected version ranges) Jun 17

Articles

~/articles/2026-07-11-ptc-windchill-flexplm-cve-2026-12569-kev-jsp-webshell

● Breaking

ptc

PTC Windchill PLM RCE is on KEV — shells still landing

PTC Windchill PDMLink and FlexPLM ship an unauth deserialization RCE. CISA added it to KEV on 2026-06-25. Unpatched instances are still catching JSP webshells.

Jul 11 read →