# CVE-2026-12569: PTC Windchill PDMLink / FlexPLM Unauthenticated Deserialization RCE (CISA KEV, JSP Web Shell Campaign)

> CVE-2026-12569 is a critical (CVSS 9.3) unauthenticated remote code execution flaw in PTC Windchill PDMLink and FlexPLM caused by deserialization of untrusted data (CWE-502 / CWE-20). A single crafted network request to the vulnerable WVS Publish servlet yields arbitrary code execution as the Windchill service account. CISA added it to the KEV catalog (BOD 22-01 deadline 2026-06-28) — the first PTC product ever listed — after threat actors were observed dropping persistent JSP web shells to enable remote command execution and intellectual-property exfiltration from aerospace, defense, automotive and manufacturing targets.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-08-19T14:49:42.126Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0954
- **ID:** TL-2026-0954
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 73 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12569

## Description

CVE-2026-12569 is an improper-input-validation / unsafe-deserialization vulnerability (CWE-20, CWE-502) in PTC Windchill PDMLink and PTC FlexPLM, the Product Lifecycle Management (PLM) platforms used across manufacturing, engineering, aerospace, defense, automotive, footwear/apparel and consumer-goods sectors (PTC reports over 1.5 million users globally, including organisations such as BMW, Lockheed Martin, Boeing and NVIDIA).

The flaw resides in the Windchill Visualization Service (WVS) Publish servlet path family (e.g. /servlet/WindchillGW/com.ptc.wvs.server.publish.Publish and the /servlet/WindchillAuthGW/ variant), which deserializes attacker-controlled data from network requests without adequate validation. Because the affected endpoint is reachable pre-authentication and the attack vector is network-based (AV:N/AC:L/PR:N/UI:N), a remote unauthenticated attacker can submit a crafted serialized payload that executes arbitrary code with the privileges of the Windchill/FlexPLM service process. CVSS v3.1 is scored 9.3-9.8 critical (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Post-exploitation, the actors write JSP web shells to the application's web root under the login path, using a randomised naming convention matching /Windchill/login/[0-9a-f]{16}.jsp. These web shells provide persistent remote command execution and data-exfiltration capability. Observed tradecraft from the closely-related Windchill/FlexPLM RCE research (CVE-2026-4681, same products and deserialization vector) includes payload parameters such as run?p=, .jsp?p=, run?c=, .jsp?c=, dropped class artifacts (GW.class, Gen.class) and randomly-named JSP files (dpr_<hex>.jsp). A telemetry artifact, flst.txt, written to /tmp or the Windchill working directory, confirms attacker file-listing/discovery activity. Requests carrying an X-windchill-req: header have been recommended as a WAF/IDS detection signal.

Network IOCs published with the campaign include the C2/exploitation IP 5.180.41.35 (command-and-control) plus exploitation sources 172.111.38.31, 216.152.148.54, 104.243.35.131 and 74.50.76.146. A BeaconBeagle lookup for the C2 IP 5.180.41.35 returned no indexed beacon/framework record at research time, so no specific C2 framework (e.g. Cobalt Strike/Sliver) attribution can be made from infrastructure correlation.

PTC alerted customers and issued mitigations on 2026-06-17, published IOCs on 2026-06-18, and released patches across the supported branches (11.0 M030, 11.1 M020, 11.2.1, 12.0.2, 12.1.2, 13.0.2, 13.1.1) by 2026-06-19. CISA added the CVE to the KEV catalog (2026-06-25, with the BOD 22-01 federal remediation deadline of 2026-06-28). Attribution remains unknown; targeting of PLM systems is consistent with intellectual-property theft against high-value industrial and defense supply chains. Interim mitigation where patching is not yet possible is to deny access to the vulnerable WVS Publish servlet path via an Apache LocationMatch "Require all denied" rule or an equivalent IIS URL-rewrite rule returning HTTP 403, and to restrict internet exposure of the Windchill login endpoint.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1036 Masquerading
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1586 Compromise Accounts
- T1027 Obfuscated Files or Information
- T1657 Financial Theft
- T1588.006 Obtain Capabilities
- T1505.003 Server Software Component
- T1071.001 Application Layer Protocol
- T1620 Reflective Code Loading
- T1036.005 Masquerading
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1552.001 Unsecured Credentials

## Sources

- [CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue](https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html)
- [NVD - CVE-2026-12569](https://nvd.nist.gov/vuln/detail/CVE-2026-12569)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-12569](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569)
- [PTC Trust Center: Remote Code Execution Vulnerability in Windchill and FlexPLM (advisory CS473270)](https://www.ptc.com/en/support/article/CS473270)
- [First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild](https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/)
- [U.S. CISA adds Cisco and PTC Windchill and FlexPLM flaws to its KEV catalog](https://securityaffairs.com/194290/security/u-s-cisa-adds-cisco-and-ptc-windchill-and-flexplm-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [Hackers exploit critical PTC Windchill PLM software flaw](https://www.csoonline.com/article/4190154/hackers-exploit-critical-ptc-windchill-plm-software-flaw.html)
- [Critical RCE Vulnerability in Windchill and FlexPLM (Kudelski Security research - related WVS Publish servlet deserialization)](https://kudelskisecurity.com/research/critical-rce-vulnerability-in-windchill-and-flexplm)
- [PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug](https://www.bleepingcomputer.com/news/security/ptc-warns-of-imminent-threat-from-critical-windchill-flexplm-rce-bug/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0954