PTC Windchill and FlexPLM CVE-2026-12569: actively exploited vulnerability added to CISA KEV

Confirmed
Discovered Jun 25, 2026

CISA added CVE-2026-12569 affecting PTC Windchill and FlexPLM to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.

1
Affected Packages
3
Observables
3
Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Am I affected?
ptc-windchill-and-flexplm
Immediate action
Audit locks, CI runners, developer workstations, and credential exposure.
Hunting
Has hunting script
Windchill and FlexPLM
PTC
CVE-2026-12569

Analysis

Executive Summary

CISA added CVE-2026-12569 for PTC Windchill and FlexPLM to the Known Exploited Vulnerabilities catalog on 2026-06-25, which is the active-exploitation gate for this Halting Problems entry [1]. NVD describes the issue as: A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions

  • The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030 [2].

This entry is intentionally evidence-conservative. The public sources reviewed for this automated refresh provide active-exploitation status, product identity, and vulnerability metadata, but they do not publish attacker-controlled infrastructure, file hashes, victim counts, or a campaign name. Source and advisory URLs are therefore kept as source selectors rather than IOC values.

Key Facts

CVE: CVE-2026-12569

Vendor: PTC

Product: Windchill and FlexPLM

KEV Added: 2026-06-25

KEV Due Date: 2026-06-28

Affected / Fixed Version Selectors:

  • ptc-windchill-and-flexplm unknown_after_direct_source_review

CVSS: 9.8 CRITICAL

Evidence Assessment

Analysis table
ClaimStatusEvidence
CISA lists CVE-2026-12569 as exploited in the wild for PTC Windchill and FlexPLM.confirmedCISA KEV entry for CVE-2026-12569 names PTC and Windchill and FlexPLM and records date added 2026-06-25 [1].
NVD has a CVE record describing the vulnerable product behavior.confirmedNVD record for CVE-2026-12569 includes the description quoted above and version metadata where available [2].
Public sources identify attacker infrastructure, hashes, or campaign attribution.not_observedCISA KEV, NVD, and linked references reviewed during this run do not publish those IOC classes.

Impact Determination

Treat internet-exposed or identity-integrated Windchill and FlexPLM systems as high-priority until version and mitigation evidence are captured. Affected systems require product log review, host-level timeline preservation, and a post-fix scan. If exploitation succeeded, defenders should decide whether sessions, API keys, service credentials, or product-managed secrets could have been accessed or abused from the compromised host.

Detection and Hunting

The reviewed hunt manifest ships with scripts/scope_ptc-windchill-flexplm-cve-2026-12569-kev.py. It scans asset inventories and exported logs for CVE-2026-12569, PTC, Windchill and FlexPLM, and affected-version selectors. Use it against CMDB exports, scanner exports, EDR file/log bundles, web server logs, and product-specific logs collected in a forensics-safe workspace.

Positive findings are scope signals, not proof of compromise. Escalate to product-specific IR by preserving UTC timelines, snapshots or hashes of relevant configs and logs, evidence owner, collection time, and chain-of-custody notes.

Remediation and Recovery Gates

  1. Confirm whether each Windchill and FlexPLM instance is affected by matching deployed version evidence against vendor/NVD ranges.
  2. Apply the vendor fixed release or documented mitigation, then capture before/after version proof.
  3. Run a post-fix scan and keep the result with the incident record.
  4. Review product logs and host telemetry for exploit success, persistence, new users, changed configuration, suspicious scheduled tasks, web shells, or unexpected outbound access.
  5. Make a credential/session rotation decision based on whether exploitation reached secrets, sessions, SSO/OIDC material, API keys, or product-managed credentials.
  6. Monitor for recurrence after recovery.

Indicators of Compromise

No attacker-controlled domains, URLs, hashes, or IP addresses were published by the sources reviewed for this entry. Machine-readable IOC fields are intentionally empty for those classes.

Open Questions

  • Which exploitation clusters are using CVE-2026-12569 in the wild?
  • Are there reliable product-specific log signatures beyond version and exposure scoping?
  • Did vendor or researcher sources publish additional affected/fixed-version detail after this automated refresh?

Timeline

6 of 6 rows

Timeline
DateEventDescriptionSource
Jun 25, 2026First seenFirst seen recorded for PTC Windchill and FlexPLM CVE-2026-12569 actively exploited vulnerability.ptc.com
Jun 25, 2026DiscoveryDiscovery recorded for PTC Windchill and FlexPLM CVE-2026-12569 actively exploited vulnerability.ptc.com
Invalid DateDisclosureDisclosure recorded for PTC Windchill and FlexPLM CVE-2026-12569 actively exploited vulnerability.ptc.com
Invalid DatePatch or fixPatch or fix recorded for PTC Windchill and FlexPLM CVE-2026-12569 actively exploited vulnerability.ptc.com
Jun 25, 2026PTC Windchill and FlexPLM CVE-2026-12569: actively exploited vulnerability added to CISA KEVUnknownptc.com
Jun 28, 2026kev due datekev due date recorded for PTC Windchill and FlexPLM CVE-2026-12569 actively exploited vulnerability.ptc.com

Affected Software

1 of 1 rows

Affected Software
PackageEcosystemVersion RangeStatusConfidenceSource
ptc-windchill-and-flexplmenterprise-softwareunknown_after_direct_source_reviewMalicious90%ptc.com; cisa.gov; nvd.nist.gov

IOC Clipboard

3 IOCs
commandWindchill and FlexPLM
commandPTC
commandCVE-2026-12569

Tested Hunting Scripts

1 of 1 rows

Tested Hunting Scripts
TitleLanguageDescriptionRepositorySource
CVE-2026-12569 asset and telemetry scopePythonDo asset inventories or exported telemetry contain CVE-2026-12569, PTC, Windchill and FlexPLM, or affected-version selectors?scripts/scope_ptc-windchill-flexplm-cve-2026-12569-kev.py opens in a new tabptc.com

Hunt Manifest: CVE-2026-12569 asset and telemetry scope

Title
CVE-2026-12569 asset and telemetry scope
Question
Do asset inventories or exported telemetry contain CVE-2026-12569, PTC, Windchill and FlexPLM, or affected-version selectors?
Telemetry Family
Python
Repository
scripts/scope_ptc-windchill-flexplm-cve-2026-12569-kev.py
Show tested hunting scriptscripts/scope_ptc-windchill-flexplm-cve-2026-12569-kev.py
scripts/scope_ptc-windchill-flexplm-cve-2026-12569-kev.py opens in a new tabPython
#!/usr/bin/env python3
"""Scope CVE-2026-12569 exposure from asset inventories and exported product logs.

Input: a directory containing CSV, JSON, JSONL, TXT, LOG, YAML, or XML exports.
The script does not contact the network. It looks for the CVE, vendor/product
selectors, and affected-version selectors recorded in the Halting Problems profile.
"""
from __future__ import annotations
import json, os, sys
from pathlib import Path
CVE_ID = 'CVE-2026-12569'
VENDOR = 'PTC'
PRODUCT = 'Windchill and FlexPLM'
AFFECTED_VERSION_SELECTORS = [
  "ptc-windchill-and-flexplm unknown_after_direct_source_review",
]
SOURCE_SELECTORS = [
  "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "https://nvd.nist.gov/vuln/detail/CVE-2026-12569",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569",
  "https://www.ptc.com/en/support/article/CS473270",
]
DOMAINS = []
HASHES = []
URLS = []
FILES = []
PROCESS_PATTERNS = [PRODUCT, VENDOR, CVE_ID]
NETWORK_PATTERNS = []
INDICATORS = [
  "CVE-2026-12569",
  "PTC",
  "Windchill and FlexPLM",
  "ptc-windchill-and-flexplm unknown_after_direct_source_review",
  "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "https://nvd.nist.gov/vuln/detail/CVE-2026-12569",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569",
  "https://www.ptc.com/en/support/article/CS473270",
]
OUT = os.environ.get("OUT", "hp-ptc-windchill-flexplm-cve-2026-12569-kev-scope")
TEXT_SUFFIXES = {'.csv','.json','.jsonl','.txt','.log','.yaml','.yml','.xml','.conf','.ini','.md'}
EXCLUDED_DIR_NAMES = {'.git','node_modules','vendor','dist','__pycache__','.venv'}
def read_text(path: Path) -> str:
    try: return path.read_text(encoding='utf-8', errors='ignore')
    except Exception: return ''
def iter_files(root: Path):
    if root.is_file():
        yield root; return
    for q in root.rglob('*'):
        if q.is_file() and not any(part in EXCLUDED_DIR_NAMES for part in q.parts):
            if not q.suffix or q.suffix.lower() in TEXT_SUFFIXES: yield q
def scan(root: Path):
    matches=[]; lowered=[s.lower() for s in INDICATORS if s]
    for path in iter_files(root):
        low=read_text(path).lower(); hits=sorted({INDICATORS[i] for i,s in enumerate(lowered) if s in low})
        if hits: matches.append({'path': str(path), 'hits': hits})
    return matches
def main(argv=None):
    argv=argv or sys.argv[1:]; root=Path(argv[0]) if argv else Path('.')
    matches=scan(root); out_dir=Path(OUT); out_dir.mkdir(parents=True, exist_ok=True)
    report={'cve': CVE_ID, 'vendor': VENDOR, 'product': PRODUCT, 'affected_version_selectors': AFFECTED_VERSION_SELECTORS, 'match_count': len(matches), 'matches': matches}
    (out_dir/'scope_report.json').write_text(json.dumps(report, indent=2), encoding='utf-8')
    print(json.dumps({'cve': CVE_ID, 'match_count': len(matches), 'report': str(out_dir/'scope_report.json')}, indent=2))
    return 2 if matches else 0
if __name__ == '__main__': raise SystemExit(main())

Provenance & Sources

3 of 3 rows

Provenance & Sources
SourceTypeReliabilityClaimsEvidence
ptc.comSecurity Researcher95%1CISA added CVE-2026-12569 affecting PTC Windchill and FlexPLM to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
cisa.govSecurity Researcher95%2CISA added CVE-2026-12569 affecting PTC Windchill and FlexPLM to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
nvd.nist.govSecurity Researcher95%1CISA added CVE-2026-12569 affecting PTC Windchill and FlexPLM to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.