CVE-2026-12569: critical vulnerability in PTC Windchill PDMLink
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A critical flaw in PTC Windchill PDMlink allows attackers to execute arbitrary code remotely by sending specially crafted data that the application unsafely processes. This can give attackers full control over the affected system.
The vulnerability stems from unsafe deserialization of untrusted data (CWE-502) with improper input validation (CWE-20). An attacker can craft malicious serialized objects and send them to the application, triggering remote code execution without requiring authentication or user interaction. The impact affects Windchill, FlexPLM, and CPS versions prior to 11.0 M030.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.