CVE-2026-12569

nvd.nist.gov • August 18, 2026

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Clop Ransomware Exploits Critical Vulnerability in Windchill and FlexPLM The Clop ransomware gang is actively exploiting a critical vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems, allowing unauthenticated remote code execution. This exploitation involves deploying JSP webshells for data exfiltration, targeting sectors such as Manufacturing, Automotive, Aerospace, and Retail/Apparel. The vulnerability was disclosed on June 18, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on June 25, 2026. Companies have begun receiving extortion emails from the Clop gang, demanding ransom for stolen data. PTC has released security patches, but unpatched systems remain at risk. The attacks were confirmed by Ransom-ISAC, which is monitoring the situation closely. 28 sources 73

Extracted Entities

CVE-2026-12569

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)