CISA
Critical PTC Windchill flaw CVE-2026-12569 under active attack
Part of the CVE-2026-12569 story · since 25 Jun
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV. This article, 4th of 11.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
The CISA maintains the Known Exploited Vulnerabilities (KEV) Catalog, which is an authoritative source for identifying vulnerabilities exploited in the wild, aimed at assisting organizations in managing these vulnerabilities effectively. The catalog can be integrated into vulnerability management frameworks and is available in various formats including CSV and JSON.
The entry for CVE-2026-12569 highlights an improper input validation vulnerability in PTC Windchill and FlexPLM, allowing remote attackers to execute arbitrary code. Organizations are urged to apply mitigations as per vendor instructions and adhere to CISA’s guidance for risk-based security updates. Users can also nominate new vulnerabilities for inclusion in the catalog and subscribe for updates.
How the story developed
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
11 articles from 5 outlets since 25 Jun. Quiet since 21 Aug. This was the 4th report, 8 hours after the first.
- Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
- Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
- Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV. This article, 4th of 11.
- Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
- Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
- Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
- Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
- Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
- Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 11 articles as a listHide the list
- Thu 25 JunDay 01
- Critical PTC Windchill flaw CVE-2026-12569 under active attack22:21 · CISA · official · First report · CISA alert · Known exploited CVE
- Fri 26 JunDay 16
- Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
- PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
- Critical PTC Windchill flaw CVE-2026-12569 under active attack06:19 · CISA · official · Known exploited CVE · This article, 4th of 11
Show 3 more from 26 Jun
- PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-1256908:31 · SecurityWeek · Known exploited CVE
- CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
Quiet for 4 weeks
Fri 24 JulDay 291- Clop ransomware hits Windchill via CVE-2026-12569 flaw12:51 · DataBreaches · Picked up again · Known exploited CVE
Quiet for 3 days
Mon 27 JulDay 321- Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw13:31 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 3 weeks
Wed 19 AugDay 551- Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign11:32 · SecurityWeek · Picked up again · Known exploited CVE
Quiet for 2 days
Fri 21 AugDay 571- Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips08:20 · Security Affairs · Known exploited CVE