CVE-2026-12569

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

Critical 9.3
Exploited: added to CISA KEV 25 Jun 2026
Used in ransomware campaigns

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

Key facts

Published: 18 Jun 2026
Last changed: 1 Aug 2026
Assigned by: PTC
KEV added: 25 Jun 2026
KEV fix due: 28 Jun 2026
Used in ransomware: Yes, according to CISA
EPSS: 46.049% likely to be exploited in the next 30 days, higher than 98.83% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

9.3CVSS 4.0, Criticalfrom the CNA (PTC)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red

What to do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-586 Object Injection (CNA impact statement)

CAPEC-153 Input Data Manipulation (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
PTC	Windchill PDMLink	Default status: unaffected 0 up to and including 11.0 M030 (affected) 11.1 M020 (affected) 11.2.1.0 (affected) 12.0.2.0 (affected) 12.1.2.0 (affected) 13.0.2.0 (affected) 13.1.0.0 (affected) 13.1.1.0 (affected) 13.1.2.0 (affected) 13.1.3.0 (affected)
PTC	FlexPLM	Default status: unaffected 0 up to and including 11.0 M030 (affected) 11.1 M020 (affected) 11.2.1.0 (affected) 12.0.0.0 (affected) 12.0.2.0 (affected) 12.1.2.0 (affected) 12.1.3.0 (affected) 13.0.2.0 (affected) 13.0.3.0 (affected)