CVE-2026-12569: PTC Windchill and FlexPLM remote code execution via deserialization

CVE-2026-12569 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2026-06-18

PTC Windchill and FlexPLM, software used by manufacturers to manage product lifecycles and data, contain a critical security flaw. An attacker can remotely take control of the system without needing a username or password. This could lead to the theft of sensitive intellectual property, disruption of manufacturing operations, or full system takeover.

Technologies: PTC FlexPLM, PTC Windchill. Vendors: PTC.

Quick answers

Is CVE-2026-12569 exploited in the wild?
Yes. CVE-2026-12569 is known to be exploited in the wild, first recorded on 25 June 2026. Treat it as urgent.
How severe is CVE-2026-12569?
Critical severity, with a CVSS score of 9.3, published 18 June 2026.
Which products and versions are affected?
PTC FlexPLM <= 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0, Prior to 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0; PTC Windchill PDMLink <= 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0, Prior to 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0.
Is there a fix for CVE-2026-12569?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12569 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12569?
Check whether you run PTC FlexPLM, PTC Windchill or PTC Windchill PDMLink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical remote code execution (RCE) vulnerability exists in PTC Windchill PDMLink and PTC FlexPLM due to the deserialization of untrusted data (CWE-502) and improper input validation (CWE-20). The flaw allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the application by sending a specially crafted request over the network. The vulnerability impacts multiple versions including those prior to 11.0 M030 and various specific releases up to 13.1.3.0. Exploitation in the wild has been reported.

Affected products

  • PTC Windchill PDMLink <= 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0
  • PTC FlexPLM <= 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.1.2.0, 12.1.3.0, 13.0.2.0, 13.0.3.0

Timeline

  • 2026-06-17: disclosed: Initial disclosure by PTC
  • 2026-06-17: advisory: NVD publication date
  • 2026-06-25: other: Reported exploited in the wild status noted in advisory summary

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.