CVE-2026-12569

PTC Windchill and FlexPLM contain an improper input validation flaw (CWE-20) with an associated deserialization of untrusted data weakness (CWE-502) that allows an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request over the network. An attacker who can reach a vulnerable Windchill or FlexPLM server can run arbitrary code on it, potentially gaining a foothold for lateral movement; CISA notes the flaw is being used in ransomware campaigns. All organizations running PTC Windchill or FlexPLM are affected, and the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-25 with known ransomware use, and EPSS assigns a 40.6% probability of exploitation within 30 days (99th percentile). No CVSS score or public proof-of-concept is available yet, but the KEV listing confirms exploitation in the wild.

What to do: Apply the fixes in PTC's security advisory for CVE-2026-12569 to both Windchill and FlexPLM as soon as possible, prioritizing internet-facing instances, and comply with the CISA KEV required action under BOD 26-04 (patch within the required window or discontinue use if mitigations are unavailable). Until patched, restrict network exposure of Windchill/FlexPLM servers and hunt for signs of exploitation or ransomware precursor activity; the available data does not list specific patched versions, so defer to PTC's advisory.