Skip to navigation

Threat reportVulnerabilityTL-2026-6073

PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

criticalPATCHED

PTC patched a critical improper input validation / deserialization of untrusted data flaw (CVE-2026-126325, CVSS v4 9.2) in Windchill and FlexPLM that allows remote code execution through crafted requests. No exploitation of this CVE has been reported; the earlier sibling flaw CVE-2026-12569 was exploited in the wild, including by suspected Cl0p affiliates.

Key facts

IdentifiersTL-2026-6073, CVE-2026-126325, CVE-2026-12569
SeverityCRITICAL
CVSS9.2
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-12569 (added )
EPSSCVE-2026-12569: 1.1% (61.7th percentile)
Affected productsPTC Windchill; PTC FlexPLM
Weaknesses (CWE)CWE-502, CWE-20
MalwareClop
MITRE ATT&CK techniquesT1005 Data from Local System, T1059 Command and Scripting Interpreter, T1071.001 Application Layer Protocol: Web Protocols, T1074.001 Data Staged: Local Data Staging, T1190 Exploit Public-Facing Application, T1505.003 Server Software Component: Web Shell, T1586.002 Compromise Accounts: Email Accounts, T1657 Financial Theft
MotivationUNKNOWN
Target sectorsmanufacturing, automotive, aerospace, retail, industrial
Target regionsGlobal, North America
Detection rules9 (1 shown free)
Sources5 cited sources

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6073 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PTC Windchill Hex-Named JSP Web Shell and Exploit Request Detection (CVE-2026-126325 / CVE-2026-12569)

Behaviour-first web-log detection for PTC Windchill/FlexPLM. Flags POST requests to hex-named JSP web shells (6 or 16 hex chars) under /Windchill/login/, the X-windchill-req request header, and requests from the 12 attacker IPs / 104.243.35.0/24 seen in the related CVE-2026-12569 exploitation (7 IPs community-corroborated by TL_OSINT_Scan, ReliaQuest sightings). CVE-2026-126325 has no confirmed exploitation, so this is precursor coverage for the same deserialization RCE attack surface.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1505.003
  • Data sources: web:access_combined (Apache/Tomcat access log), web:ms:iis:auto (IIS W3C log), W3CIISLog (Sentinel), CommonSecurityLog (WAF/proxy)
  • Severity: high
  • Confidence: high

Splunk SPL

```CVE-2026-126325 / CVE-2026-12569 precursor: Windchill web-shell and exploit-request hunting in web logs```
index=web (sourcetype=access_combined OR sourcetype="ms:iis:auto" OR sourcetype=iis) earliest=-24h
| eval uri=lower(coalesce(uri_path, cs_uri_stem, uri)), meth=upper(coalesce(http_method, cs_method, method)), client=coalesce(src, c_ip, clientip, src_ip)
| eval hex_jsp_post=if(meth="POST" AND match(uri,"^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$"),1,0)
| eval xreq_header=if(match(_raw,"(?i)x-windchill-req"),1,0)
| eval known_ioc_ip=if((cidrmatch("104.243.35.0/24",client) OR in(client,"5.180.41.35","216.152.148.54","216.152.151.204","104.243.35.63","104.243.35.131","172.111.38.31","74.50.76.146","104.194.9.14","209.222.98.44","185.227.83.236","78.128.113.10","38.60.157.212")) AND match(uri,"^/windchill/"),1,0)
| where hex_jsp_post=1 OR xreq_header=1 OR known_ioc_ip=1
| eval reason=mvappend(if(hex_jsp_post=1,"POST to hex-named JSP under /Windchill/login/",null()), if(xreq_header=1,"X-windchill-req header",null()), if(known_ioc_ip=1,"known CVE-2026-12569 attacker IP",null()))
| stats count min(_time) as first_seen max(_time) as last_seen values(reason) as reason values(uri) as uris values(status) as http_status by client host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// CVE-2026-126325 / CVE-2026-12569 precursor: hex-named Windchill JSP web shell POSTs, X-windchill-req header, known attacker IPs
let KnownIPs = dynamic(["5.180.41.35", "216.152.148.54", "216.152.151.204", "104.243.35.63", "104.243.35.131", "172.111.38.31", "74.50.76.146", "104.194.9.14", "209.222.98.44", "185.227.83.236", "78.128.113.10", "38.60.157.212"]);
let IisHits = W3CIISLog
    | where TimeGenerated > ago(24h)
    | where (csMethod =~ "POST" and csUriStem matches regex @"(?i)^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$")
        or (csUriStem startswith "/Windchill" and (cIP in (KnownIPs) or ipv4_is_in_range(cIP, "104.243.35.0/24")))
    | project TimeGenerated, SourceIp = cIP, Host = Computer, Method = csMethod, Url = csUriStem, Status = tostring(scStatus), Evidence = "hex-named JSP POST or known attacker IP";
let WafHits = CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where AdditionalExtensions has "X-windchill-req" or Message has "X-windchill-req" or RequestURL matches regex @"(?i)/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$"
    | project TimeGenerated, SourceIp = SourceIP, Host = Computer, Method = RequestMethod, Url = RequestURL, Status = tostring(EventOutcome), Evidence = "X-windchill-req header or hex JSP URL (WAF/proxy)";
union IisHits, WafHits
| order by TimeGenerated desc

Sigma

title: PTC Windchill Hex-Named JSP Web Shell POST or Known Campaign IP
id: 7c1e4b2a-3d58-4f1a-9b6e-2a8d51c0e101
status: experimental
description: Detects POST requests to hex-named JSP files (6 or 16 hex characters) under /Windchill/login/ and requests from IP infrastructure tied to the related CVE-2026-12569 Windchill exploitation campaign. Precursor hunting content for CVE-2026-126325 (Windchill/FlexPLM deserialization RCE).
references:
  - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
  - https://www.cve.org/CVERecord?id=CVE-2026-126325
  - https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html
  - https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
author: Threadlinqs Team
date: 2026-11-14
tags:
  - cve.2026.126325
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_shell:
    cs-method: 'POST'
    c-uri|re: '(?i)^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp(\?.*)?$'
  selection_ip:
    c-ip|cidr:
      - '5.180.41.35/32'
      - '216.152.148.54/32'
      - '216.152.151.204/32'
      - '104.243.35.63/32'
      - '104.243.35.131/32'
      - '172.111.38.31/32'
      - '74.50.76.146/32'
      - '104.194.9.14/32'
      - '209.222.98.44/32'
      - '185.227.83.236/32'
      - '78.128.113.10/32'
      - '38.60.157.212/32'
      - '104.243.35.0/24'
    c-uri|startswith: '/Windchill'
  condition: selection_shell or selection_ip
falsepositives:
  - Legitimate Windchill customisations that use short hex-named JSP files under /Windchill/login/ (unlikely, verify against change records)
  - Authorised vulnerability scanners or red-team activity from listed network ranges
level: high

Known false positives:

  • Vulnerability scanners or penetration tests against Windchill that request /Windchill/login/ paths
  • Legitimate short hex-named JSP files shipped by a Windchill customisation

Tuning notes: Ensure the web access log is indexed in index=web and that uri_path/cs_uri_stem, method and client IP fields are extracted; adjust index/sourcetype to your environment. Log the X-windchill-req header (custom log format or WAF) for header coverage. Exclude approved scanner IPs. Refresh the known-IP list from the PTC advisory and TL_OSINT_Scan.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • PTC Windchill Java Server Spawning Shell or Interpreter (Exploitation) · unlock with TL Creds
  • Windchill Engineering Data Staging via Archive Tools · unlock with TL Creds
  • Windchill Server Bulk Egress to Public Destinations · unlock with TL Creds
  • PTC Windchill Hex-Named JSP Web Shell File Creation · unlock with TL Creds
  • Windchill Java Process Running File System Enumeration · unlock with TL Creds
  • Windchill Campaign Attacker Infrastructure Network Contact · unlock with TL Creds
  • Windchill File System Enumeration Artifact [indicator] · unlock with TL Creds
  • Windchill Web Shell HTTP Command-and-Control Burst · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-6073.

Sample indicators (3 of 19)

  • IP address: 5.180.41[.]35
  • File hash: 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c
  • IP address: 216.152.148[.]54

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

19 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

7 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

CVE-2026-126325 is an improper input validation and deserialization of untrusted data vulnerability in PTC Windchill and PTC FlexPLM, scored CVSS v4 9.2 (critical). A remote attacker can send crafted requests to achieve remote code execution on the application server. Per the CVE record, affected Windchill releases are 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0; affected FlexPLM releases are the same list up to 13.1.3.0. The public reporting (The Hacker News, 2026-11-12) does not state fixed version numbers; the PTC advisory is the authoritative source for patch levels. PTC-hosted environments were patched by PTC on customers' behalf; self-hosted customers must apply the patch.

As of the source reporting there is no evidence of exploitation, no public PoC and no IOCs for CVE-2026-126325 itself. Defenders should nevertheless treat it as high-risk because a closely related flaw, CVE-2026-12569 (CVSS 9.3, also described by PTC as exploitable via deserialization of untrusted data), was added to CISA KEV on 2026-06-25 (the first PTC product in KEV) and was used to deploy hex-named JSP web shells under /Windchill/login/. In July 2026 suspected Cl0p ransomware affiliates were reported chaining a pre-authentication information disclosure on the FlexPLM WSDL endpoint (CVSS v3.1 7.5, no CVE) with the Windchill login servlet flaw for unauthenticated RCE, enumerating the file system, staging engineering/design data, exfiltrating it and sending extortion emails from previously compromised accounts. ReliaQuest says attribution is unconfirmed although the tradecraft resembles past Cl0p campaigns. watchTowr's Yordan Ganchev describes PTC software as a common target for initial access brokers and ransomware operators.

The IOCs and hunting artifacts in this record come from the CVE-2026-12569 campaign and are included as precursor/related hunting guidance, not as confirmed indicators of CVE-2026-126325 exploitation. Source mitigations: patch self-hosted systems as soon as possible, apply network restrictions if patching is delayed, and monitor for code execution, backdoor access and web shells. Censys counted about 80 internet-exposed Windchill instances on 2026-07-20 (about 80% in the U.S., nearly a quarter on Akamai infrastructure).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074.001 Data Staged: Local Data Staging

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Resource Development

T1586.002 Compromise Accounts: Email Accounts

Impact

T1657 Financial Theft

Remediation

Patches

  • Apply the fixed releases listed in the PTC advisory for CVE-2026-126325 (fixed version numbers are not stated in the public news reporting)

Immediate actions

  • Apply the PTC patch to all self-hosted Windchill and FlexPLM instances as soon as possible
  • Restrict internet exposure of the Windchill login endpoint and apply network restrictions if patching is delayed
  • Monitor hosts for signs of code execution, backdoor access and web shells
  • Hunt for POST requests to /Windchill/login/*.jsp and JSP files matching the hex-named web shell patterns
  • Block the related CVE-2026-12569 campaign IPs (e.g. 5.180.41.35) at the perimeter

Workarounds

  • If patching is delayed, apply network restrictions to limit access to Windchill and FlexPLM
  • PTC-hosted environments were patched by PTC; no customer action required

Longer-term hardening

  • Remove PLM application servers from direct internet exposure; front with VPN or authenticated reverse proxy
  • Add WAF/IDS rules for the X-windchill-req: header seen in the related campaign
  • Monitor Windchill web roots for newly created JSP files and enforce file integrity monitoring

Affected and fixed versions

  • PTC — Windchill
    Vulnerable versions: 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0
    Fixed in: See PTC advisory (fixed versions not stated in public reporting)
  • PTC — FlexPLM
    Vulnerable versions: 11.0 M030; 11.1 M020; 11.2.1.0; 12.0.2.0; 12.1.2.0; 13.0.2.0; 13.1.0.0; 13.1.1.0; 13.1.2.0; 13.1.3.0
    Fixed in: See PTC advisory (fixed versions not stated in public reporting)

Timeline

  • Censys counts fewer than 100 internet-exposed Windchill instances.
  • PTC publishes advisory for the related Windchill/FlexPLM flaw CVE-2026-12569 (CVSS 9.3); exposed instances decline afterward.
  • CISA adds CVE-2026-12569 to the KEV catalog, the first PTC product flaw listed; JSP web shells observed on vulnerable systems.
  • Censys counts about 80 internet-exposed Windchill instances, roughly 80% in the U.S.
  • Joint Ransom-ISAC, eCrime.ch and DEFUSED advisory reported: suspected Cl0p affiliates chain FlexPLM WSDL info disclosure with Windchill RCE, deploy JSP web shells and run data extortion against manufacturers.
  • PTC patches CVE-2026-126325 (CVSS v4 9.2) in Windchill and FlexPLM; no exploitation reported; PTC-hosted environments already patched.

Sources cited

Other reports on CVE-2026-12569

Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats