Vulnerability intelligence
CVE-2026-12569
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This advisory also applies to all CPS versions The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CVSS Score
9.3
Critical
EPSS — Exploit Probability
30%
Riskier than 98% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-06-25
Remediation
unknown
Federal deadline 2026-06-28
9 articles across 6 outlets · first covered Jun 25, 2026 · latest Jul 27, 2026
Associated threat actors
Coverage timeline
-
Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flawwww.securityweek.com · Jul 27, 2026
-
Clop ransomware hits Windchill via CVE-2026-12569 flawdatabreaches.net · Jul 24, 2026
-
Cisco SD-WAN Zero-Day Exploited in Attackssecurityonline.info · Jun 26, 2026
-
CISA adds critical PTC Windchill, Cisco UC flaws to KEV listsecurityaffairs.com · Jun 26, 2026
-
PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569www.securityweek.com · Jun 26, 2026
-
Critical PTC Windchill flaw CVE-2026-12569 under active attackwww.cisa.gov · Jun 26, 2026
-
PTC Windchill flaw spotted; Claude Fable 5 hints at AWS returnsecurityonline.info · Jun 26, 2026
-
Cisco and PTC flaws under active attack, CISA adds to KEV listsecurityonline.info · Jun 26, 2026
-
Critical PTC Windchill flaw CVE-2026-12569 under active attackcisa.gov · Jun 25, 2026