Detections
Analytics

CVE-2026-12569

critical

Description

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

References

https://www.ptc.com/en/support/article/CS473270

https://webflow.sysdig.com/blog/security-briefing-august-2026

https://securityaffairs.com/197587/cyber-crime/cl0p-targets-40-organizations-through-ptc-windchill-flaw.html

https://www.securityweek.com/cl0p-ransomware-group-names-over-40-victims-of-ptc-windchill-campaign/

https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html

https://cyberscoop.com/clop-zero-day-attacks-ptc-windchill-flexplm/

https://www.bleepingcomputer.com/news/security/clop-created-custom-web-shell-for-windchill-data-theft-attacks/

https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/

https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/

https://www.bleepingcomputer.com/news/security/shell-investigates-potential-incident-after-clop-data-theft-claims/

https://www.securityweek.com/ptc-windchill-vulnerability-exploited-in-ransomware-campaign/

https://www.databreachtoday.com/clop-tied-to-ptc-product-lifecycle-management-software-hits-a-32333

https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html

https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/

https://www.helpnetsecurity.com/2026/06/29/ptc-windchill-cve-2026-12569-exploited/

https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/

https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/

https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html

https://securityaffairs.com/194290/security/u-s-cisa-adds-cisco-and-ptc-windchill-and-flexplm-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569

Details

Source: Mitre, NVD

Published: 2026-06-18

Updated: 2026-08-01

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Severity: Critical

EPSS

EPSS: 0.40586

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest