Critical RCE Vulnerability in PTC Windchill and FlexPLM Under Active Exploitation

Csoonline

Critical RCE Vulnerability in PTC Windchill and FlexPLM Under Active Exploitation

First seen 29 Jun 2026, 14:59 UTC • •78.0

Article Content

1 / 3

Browse articles

ThreatCluster •June 30, 2026 at 14:42 UTC

•CVE-2026-12569 allows remote code execution in PTC Windchill and FlexPLM software.
•Active exploitation has been confirmed, prompting urgent patching recommendations.
•PTC has provided indicators of compromise to help organizations detect potential intrusions.

Hackers are exploiting a critical vulnerability in PTC Windchill and FlexPLM, tracked as CVE-2026-12569, which allows remote code execution due to an unsafe deserialization flaw. This vulnerability affects product lifecycle management systems used across various industries, including defense and aerospace. PTC released patches on June 17, 2026, but reports of active exploitation have surged, prompting the US CISA to add it to its Known Exploited Vulnerabilities catalog on June 25. Organizations are urged to apply patches immediately to mitigate risks of data theft and system compromise. The vulnerability has a CVSS severity score of 9.3, indicating a high level of danger. Indicators of compromise have been shared, and organizations are advised to enhance monitoring capabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 93d ago How this analysis works

Timeline

2026-06-17

PTC releases patches for Windchill and FlexPLM

PTC issued updates to fix the critical vulnerability affecting multiple versions of its software.

2026-06-25

CISA adds CVE-2026-12569 to KEV catalog

The US Cybersecurity and Infrastructure Security Agency confirmed active exploitation of the vulnerability.

2026-06-29

CCB issues urgent patching advisory

The Centre for Cybersecurity Belgium emphasized the need for immediate patching due to confirmed exploitation.

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Malware
Zero-day Exploit
T1203 - Exploitation for Client Execution
T1505.003 - Web Shell

Vulnerability (1)

CVE-2026-12569

Weakness (1)

CWE-502 - Deserialization Of Untrusted Data

Relationships

CVE-2026-12569 related to Malware
CVE-2026-12569 related to Zero-day Exploit
CVE-2026-12569 related to CWE-502 - Deserialization Of Untrusted Data
CVE-2026-12569 related to T1203 - Exploitation for Client Execution
CVE-2026-12569 related to T1505.003 - Web Shell

Following this threat?

Track CVE-2026-12569 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Multiple Ransomware Attacks Target Various Organizations In September 2026, multiple organizations, including watchops.com and geekybunch.com, were reported as victims of ransomware attacks by the group known as 'unsafe'. The incidents were listed on dark web leak sites, but details regarding the nature of the attacks, such as data encryption or theft, remain vague. The…

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…