Skip to content
Sign in
9.3 Critical

CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns Known to be used
Weakness CWE-20, CWE-502

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Affected products and versions

Product Affected versions Fixed in
Windchill PDMLink 13.1 13.1.0.0 → 13.1.3.0 No fix stated
Windchill PDMLink 13.0.2.0 No fix stated
Windchill PDMLink 12.1.2.0 No fix stated
Windchill PDMLink 12.0.2.0 No fix stated
Windchill PDMLink 11.2.1.0 No fix stated
FlexPLM 13.0 13.0.2.0 → 13.0.3.0 No fix stated
FlexPLM 12.1 12.1.2.0 → 12.1.3.0 No fix stated
FlexPLM 12.0 12.0.0.0 → 12.0.2.0 No fix stated
FlexPLM 11.2.1.0 No fix stated

Other CVEs of Windchill PDMLink

The 4 CVEs of Windchill PDMLink →
CVE-2026-77646 A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM 7.7 High CVE-2026-77645 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM 9.2 Critical CVE-2026-4681 A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM 9.3 Critical
Track this CVE