Threat reportVulnerabilityTL-2026-0954
CVE-2026-12569: PTC Windchill PDMLink / FlexPLM Unauthenticated Deserialization RCE (CISA KEV, JSP Web Shell Campaign)
CVE-2026-12569 (TL-2026-0954), also tracked as PTC Windchill RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-26 and last reviewed 2026-08-19. It is linked to a Russia-nexus actor with high confidence, affects PTC Windchill PDMLink, references 1 CVE (CVE-2026-12569), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 73 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 26MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 73Indicators of compromise
Key facts for TL-2026-0954
- Threat ID
- TL-2026-0954
- Also known as
- PTC Windchill RCE, Windchill/FlexPLM Deserialization RCE
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- defense, aerospace, automotive, manufacturing, healthcare, electronics, industrial machinery, consumer goods, footwear and apparel, retail
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 73
- Updates
- 2026-08-19 · 5 updates · revalidated 4× · latest source
How CVE-2026-12569 works
CVE-2026-12569 is a critical (CVSS 9.3) unauthenticated remote code execution flaw in PTC Windchill PDMLink and FlexPLM caused by deserialization of untrusted data (CWE-502 / CWE-20). A single crafted network request to the vulnerable WVS Publish servlet yields arbitrary code execution as the Windchill service account. CISA added it to the KEV catalog (BOD 22-01 deadline 2026-06-28) — the first PTC product ever listed — after threat actors were observed dropping persistent JSP web shells to enable remote command execution and intellectual-property exfiltration from aerospace, defense, automotive and manufacturing targets.
CVE-2026-12569 is an improper-input-validation / unsafe-deserialization vulnerability (CWE-20, CWE-502) in PTC Windchill PDMLink and PTC FlexPLM, the Product Lifecycle Management (PLM) platforms used across manufacturing, engineering, aerospace, defense, automotive, footwear/apparel and consumer-goods sectors (PTC reports over 1.5 million users globally, including organisations such as BMW, Lockheed Martin, Boeing and NVIDIA).
The flaw resides in the Windchill Visualization Service (WVS) Publish servlet path family (e.g. /servlet/WindchillGW/com.ptc.wvs.server.publish.Publish and the /servlet/WindchillAuthGW/ variant), which deserializes attacker-controlled data from network requests without adequate validation. Because the affected endpoint is reachable pre-authentication and the attack vector is network-based (AV:N/AC:L/PR:N/UI:N), a remote unauthenticated attacker can submit a crafted serialized payload that executes arbitrary code with the privileges of the Windchill/FlexPLM service process. CVSS v3.1 is scored 9.3-9.8 critical (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Post-exploitation, the actors write JSP web shells to the application's web root under the login path, using a randomised naming convention matching /Windchill/login/[0-9a-f]{16}.jsp. These web shells provide persistent remote command execution and data-exfiltration capability. Observed tradecraft from the closely-related Windchill/FlexPLM RCE research (CVE-2026-4681, same products and deserialization vector) includes payload parameters such as run?p=, .jsp?p=, run?c=, .jsp?c=, dropped class artifacts (GW.class, Gen.class) and randomly-named JSP files (dpr_<hex>.jsp). A telemetry artifact, flst.txt, written to /tmp or the Windchill working directory, confirms attacker file-listing/discovery activity. Requests carrying an X-windchill-req: header have been recommended as a WAF/IDS detection signal.
Network IOCs published with the campaign include the C2/exploitation IP 5.180.41.35 (command-and-control) plus exploitation sources 172.111.38.31, 216.152.148.54, 104.243.35.131 and 74.50.76.146. A BeaconBeagle lookup for the C2 IP 5.180.41.35 returned no indexed beacon/framework record at research time, so no specific C2 framework (e.g. Cobalt Strike/Sliver) attribution can be made from infrastructure correlation.
PTC alerted customers and issued mitigations on 2026-06-17, published IOCs on 2026-06-18, and released patches across the supported branches (11.0 M030, 11.1 M020, 11.2.1, 12.0.2, 12.1.2, 13.0.2, 13.1.1) by 2026-06-19. CISA added the CVE to the KEV catalog (2026-06-25, with the BOD 22-01 federal remediation deadline of 2026-06-28). Attribution remains unknown; targeting of PLM systems is consistent with intellectual-property theft against high-value industrial and defense supply chains. Interim mitigation where patching is not yet possible is to deny access to the vulnerable WVS Publish servlet path via an Apache LocationMatch "Require all denied" rule or an equivalent IIS URL-rewrite rule returning HTTP 403, and to restrict internet exposure of the Windchill login endpoint.
MITRE ATT&CK techniques used in TL-2026-0954
Collection
T1005 Data from Local System; T1074 Data Staged
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Masquerading; T1078 Valid Accounts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Command and Control
T1071 Application Layer Protocol; T1071.001 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505 Server Software Component; T1505.003 Server Software Component
Credential Access
T1552.001 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities; T1588.006 Obtain Capabilities
Reconnaissance
Impact
Affected products and versions in CVE-2026-12569
- PTC — Windchill PDMLink
Vulnerable versions: <= 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0
Fixed in: 11.0 M030 (patched); 11.1 M020 (patched); 11.2.1 (patched); 12.0.2 (patched); 12.1.2 (patched); 13.0.2 (patched); 13.1.1 (patched) - PTC — FlexPLM
Vulnerable versions: <= 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.0.0; 12.0.2.0; 12.0.3.0; 12.1.2.0; 12.1.3.0; 13.0.2.0; 13.0.3.0
Fixed in: 11.0 M030 (patched); 11.1 M020 (patched); 11.2.1 (patched); 12.0.2 (patched); 12.1.2 (patched); 13.0.2 (patched); 13.1.1 (patched)
Remediation for CVE-2026-12569
Patches
- PTC patches for Windchill PDMLink and FlexPLM versions 11.0 M030, 11.1 M020, 11.2.1, 12.0.2, 12.1.2, 13.0.2 and 13.1.1 (PTC advisory / CS473270).
Immediate actions
- Apply the PTC patch for your branch immediately: Windchill PDMLink / FlexPLM 11.0 M030, 11.1 M020, 11.2.1, 12.0.2, 12.1.2, 13.0.2 or 13.1.1 (per PTC advisory CS473270).
- Block the C2 address 5.180.41.35 and exploitation source IPs 172.111.38.31, 216.152.148.54, 104.243.35.131 and 74.50.76.146 at the perimeter firewall.
- Hunt for JSP web shells matching /Windchill/login/[0-9a-f]{16}.jsp and search for the flst.txt artifact in /tmp and the Windchill working directory.
Workarounds
- Apache: deny the vulnerable WVS Publish servlet path with a <LocationMatch> block using 'Require all denied'.
- IIS: add a URL-rewrite rule in web.config returning HTTP 403 for the vulnerable servlet endpoints.
- WAF/IDS: block requests carrying the X-windchill-req: header and POST requests to /Windchill/login/*.jsp.
Longer-term hardening
- Remove Windchill/FlexPLM login endpoints from direct internet exposure; place behind VPN or reverse-proxy with authentication.
- Deploy EDR with web-shell and behavioral detection on Windchill application servers and monitor for JSP writes to the web root.
- Establish file-integrity monitoring of the Windchill web root and servlet directories.
CVEs associated with CVE-2026-12569
Weaknesses (CWE) in CVE-2026-12569
Timeline of CVE-2026-12569
Showing the 20 most recent tracked events.
- PTC released patches across supported branches: 11.0 M030, 11.1 M020, 11.2.1, 12.0.2, 12.1.2, 13.0.2 and 13.1.1.
- PTC confirmed heightened threat activity with continued exploitation deploying persistent JSP web shells.
- CISA added CVE-2026-12569 to the Known Exploited Vulnerabilities catalog (first PTC product ever listed) with a BOD 22-01 federal remediation deadline of 2026-06-28.
- Public reporting (The Hacker News, SecurityWeek, CSO Online, Security Affairs) detailed ongoing exploitation, IOCs, and the web-shell naming pattern /Windchill/login/[0-9a-f]{16}.jsp.
- CISA BOD 22-01 deadline for U.S. federal civilian agencies to remediate CVE-2026-12569.
- Help Net Security reports JSP web shells actively being dropped on unpatched, internet-exposed PTC Windchill instances following CVE-2026-12569 exploitation.
- Independent technical deep-dive confirms the deserialization sink (Publish.doPublishRep -> Encoder.decode() -> ObjectInputStream.readObject() with no filter), demonstrating a CommonsBeanutils1 gadget chain aligned to commons-beanutils 1.8.3 as bundled in Windchill.
- Cl0p registers new extortion-email domains cypherhex.com and cryptohox.com via bulletproof CNOBIN registrar, with mail infrastructure (Roundcube Webmail 1.7.2) on hosts in Bulgaria and Russia.
- Exposure tracking showed roughly 80 internet-facing Windchill instances still online, 80% US-hosted and about 25% on Akamai infrastructure.
- Cl0p launches a dedicated extortion wave against compromised Windchill/FlexPLM victims, sending mass emails from compromised accounts with the subject line "Windchill PDMLink module serious data leak."
- ReliaQuest publicly reports observations of Cl0p exploitation with a custom Windchill-specific web shell, confirming an application-specific implant rather than a generic web shell.
- No Windchill/FlexPLM victim organizations have yet appeared on Cl0p's dark-web leak site despite the ongoing extortion email wave.
- Cyberpress reports Cl0p exploiting the Windchill zero-day chain to deploy web shells and steal engineering/design data, publishing additional IOCs and the WSDL reconnaissance probe pattern.
- Ransom-ISAC, eCrime.ch, and DEFUSED issued a joint advisory detailing the Cl0p Windchill/FlexPLM exploitation chain and additional IOCs.
- The Hacker News and BleepingComputer confirm Cl0p affiliates chaining the FlexPLM WSDL info-disclosure flaw with the Windchill login-servlet deserialization flaw for unauthenticated RCE, with extortion emails sent to hundreds of individual users at victim organizations.
- Shell confirmed it is aware of a potential incident and is investigating with its security teams and outside experts.
- Clop listed Shell among 43 newly named alleged victims on its extortion leak site, claiming roughly 89GB of stolen engineering drawings, facility testing reports, photographs, and project plans; General Electric and Philips were also newly named.
- Philips confirms a breach (15.5 GB, contained, no customer impact); Shell, GE, and Fiserv confirm investigations; GE's listing is later removed from the leak site, possibly indicating negotiation or payment.
- ReliaQuest publishes a full technical analysis of the custom Windchill web shell (LDAP credential theft, in-memory Java loader); BleepingComputer, The Hacker News, and Censys publish corroborating reporting and infrastructure analysis.
- Campaign remains ongoing with a 'long tail' of victims still emerging; the web shell survives patching unless separately hunted and removed.
Update history for TL-2026-0954
- 2026-08-19 — Clop mass exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM — zero-day RCE, custom web shell, 44+ victims: What changed CVSS 9.3 - 9.8 (aligned to the published 3.1 vector); attribution_confidence MEDIUM - HIGH; nation_state Unknown - Russia, based on new technical/attribution reporting (ReliaQuest, Censys, The Hacker News). Severity, exploitabi
- 2026-08-19 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 7 newly-corroborated indicator(s).
- 2026-08-14 — Shell Investigates Potential Data Theft Incident After Clop Claims Tied to CVE-2026-12569 (PTC Windchill/FlexPLM): What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE) and attribution_confidence (MEDIUM) are unchanged. The campaign progressed from an extortion-email wave with no leak-site listings (as of 2026
- 2026-07-26 — Cl0p Ransomware Exploits CVE-2026-12569 in PTC Windchill and FlexPLM for Data Theft Extortion: What changed No escalation to severity, exploitability, or status (all already CRITICAL/ACTIVE/ACTIVE). The newer report reframes the previously-recorded WSDL reconnaissance probe (/Windchill/rfa/jsp/login/ .jsp?wsdl) as an actual chained p
- 2026-07-25 — Cl0p Affiliates Exploit CVE-2026-12569 in PTC Windchill and FlexPLM for Unauthenticated RCE: What changed Attribution: Unattributed → Cl0p (FIN11/TA505/Graceful Spider/Lace Tempest/Chubby Scorpius), attribution_confidence NONE → MEDIUM, motivation ESPIONAGE → FINANCIAL. Severity, CVSS, exploitability and status are unchanged (still
Sources cited for CVE-2026-12569
- CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
- NVD - CVE-2026-12569
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-12569
- PTC Trust Center: Remote Code Execution Vulnerability in Windchill and FlexPLM (advisory CS473270)
- First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild
- U.S. CISA adds Cisco and PTC Windchill and FlexPLM flaws to its KEV catalog
- Hackers exploit critical PTC Windchill PLM software flaw
- Critical RCE Vulnerability in Windchill and FlexPLM (Kudelski Security research - related WVS Publish servlet deserialization)
- PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug
Detection coverage for TL-2026-0954
As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0954 across Splunk SPL, Microsoft KQL and Sigma, covering 73 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.