Skip to content
Sign in
CVE-2026-125699.3CriticalCWE-20

CVE-2026-12569: PTC Windchill and FlexPLM Improper Input Validation Vulnerability

PTC · Windchill and FlexPLM

Vendor fix available · Affected: PTC Windchill and FlexPLM · Exploitation: in CISA KEV since 25 Jun

Known ransomware useExploitation attributed to Clop (according to ReliaQuest)

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue25 Jun
  2. Exploited (reported)ReliaQuest, via DataBreaches24 Jul
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not established: not seen

Who exploits it, and who says so

46.0%probability of exploitation in the next 30 days
98th percentile
050100

Higher than 98% of scored CVEs

9.3CriticalCVSS 4.0
LowCrit.

Federal deadline

CISA KEV · added 25 Jun · catalogue entry

Passed 134 days ago

DescriptionNVD

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This advisory also applies to all CPS versions The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

What changed

  1. CISA’s KEV entry now notes known ransomware use CISA
  2. Security Affairs reported exploitation by Cl0p Security Affairs
  3. SecurityWeek reported exploitation by Cl0p SecurityWeek
  4. SecurityWeek reported exploitation by Cl0p SecurityWeek
  5. DataBreaches reported exploitation by Cl0p DataBreaches
  6. DataBreaches reported exploitation by Clop DataBreaches
  7. DataBreaches reported exploitation, according to ReliaQuest DataBreaches
  8. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage11 articles · 5 outlets

One row per outlet, in order of first report. First in our coverage: CISA, 25 Jun.

Full timeline
Quiet for 12 weekslast report 21 Aug11 articles5 outlets
25 Jun · CISA first12 Aug5 Sep29 SepNow
  • Thu 25 Jun, 22:21 UTC. CISA, first report. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline, its first report on the story. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. Critical PTC Windchill flaw CVE-2026-12569 under active attack. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 08:31 UTC. SecurityWeek, its first report on the story. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs, its first report on the story. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
  • Fri 21 Aug, 08:20 UTC. Security Affairs. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
All coveragerunning total11CISA2SecurityOnl…3SecurityWeek3Security Af…2DataBreaches126 Jun11 Aug26 SepNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
11 articles about CVE-2026-12569 from 5 outlets
Published (UTC)OutletHeadline
25 Jun 22:21CISACritical PTC Windchill flaw CVE-2026-12569 under active attack
26 Jun 03:31SecurityOnlineCisco and PTC flaws under active attack, CISA adds to KEV list
26 Jun 05:40SecurityOnlinePTC Windchill flaw spotted; Claude Fable 5 hints at AWS return
26 Jun 06:19CISACritical PTC Windchill flaw CVE-2026-12569 under active attack
26 Jun 08:31SecurityWeekPTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569
26 Jun 11:31Security AffairsCISA adds critical PTC Windchill, Cisco UC flaws to KEV list
26 Jun 14:21SecurityOnlineCisco SD-WAN Zero-Day Exploited in Attacks
24 Jul 12:51DataBreachesClop ransomware hits Windchill via CVE-2026-12569 flaw
27 Jul 13:31SecurityWeekCl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw
19 Aug 11:32SecurityWeekCl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
21 Aug 08:20Security AffairsCl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips
  1. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips
    Security Affairs
  2. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
    SecurityWeek
  3. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw
    SecurityWeek
  4. Clop ransomware hits Windchill via CVE-2026-12569 flaw
    DataBreaches
  5. Cisco SD-WAN Zero-Day Exploited in Attacks
    SecurityOnline
  6. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list
    Security Affairs
  7. PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-12569
    SecurityWeek
  8. Critical PTC Windchill flaw CVE-2026-12569 under active attack
    CISA · official notice
Show 3 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in