# PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

> PTC patched a critical improper input validation / deserialization of untrusted data flaw (CVE-2026-126325, CVSS v4 9.2) in Windchill and FlexPLM that allows remote code execution through crafted requests. No exploitation of this CVE has been reported; the earlier sibling flaw CVE-2026-12569 was exploited in the wild, including by suspected Cl0p affiliates.

- **Published:** 2026-11-14T11:54:47Z
- **Last reviewed:** 2026-11-14T11:54:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6073
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6073.png
- **ID:** TL-2026-6073
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)
- **CVEs:** CVE-2026-126325, CVE-2026-12569

## Description

CVE-2026-126325 is an improper input validation and deserialization of untrusted data vulnerability in PTC Windchill and PTC FlexPLM, scored CVSS v4 9.2 (critical). A remote attacker can send crafted requests to achieve remote code execution on the application server. Per the CVE record, affected Windchill releases are 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0 and 13.1.4.0; affected FlexPLM releases are the same list up to 13.1.3.0. The public reporting (The Hacker News, 2026-11-12) does not state fixed version numbers; the PTC advisory is the authoritative source for patch levels. PTC-hosted environments were patched by PTC on customers' behalf; self-hosted customers must apply the patch.

As of the source reporting there is no evidence of exploitation, no public PoC and no IOCs for CVE-2026-126325 itself. Defenders should nevertheless treat it as high-risk because a closely related flaw, CVE-2026-12569 (CVSS 9.3, also described by PTC as exploitable via deserialization of untrusted data), was added to CISA KEV on 2026-06-25 (the first PTC product in KEV) and was used to deploy hex-named JSP web shells under /Windchill/login/. In July 2026 suspected Cl0p ransomware affiliates were reported chaining a pre-authentication information disclosure on the FlexPLM WSDL endpoint (CVSS v3.1 7.5, no CVE) with the Windchill login servlet flaw for unauthenticated RCE, enumerating the file system, staging engineering/design data, exfiltrating it and sending extortion emails from previously compromised accounts. ReliaQuest says attribution is unconfirmed although the tradecraft resembles past Cl0p campaigns. watchTowr's Yordan Ganchev describes PTC software as a common target for initial access brokers and ransomware operators.

The IOCs and hunting artifacts in this record come from the CVE-2026-12569 campaign and are included as precursor/related hunting guidance, not as confirmed indicators of CVE-2026-126325 exploitation. Source mitigations: patch self-hosted systems as soon as possible, apply network restrictions if patching is delayed, and monitor for code execution, backdoor access and web shells. Censys counted about 80 internet-exposed Windchill instances on 2026-07-20 (about 80% in the U.S., nearly a quarter on Akamai infrastructure).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1074.001 Data Staged: Local Data Staging
- T1071.001 Application Layer Protocol: Web Protocols
- T1586.002 Compromise Accounts: Email Accounts
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PTC Windchill Hex-Named JSP Web Shell and Exploit Request Detection (CVE-2026-126325 / CVE-2026-12569)** (`TL-2026-6073-SPL-001`)

Behaviour-first web-log detection for PTC Windchill/FlexPLM. Flags POST requests to hex-named JSP web shells (6 or 16 hex chars) under /Windchill/login/, the X-windchill-req request header, and requests from the 12 attacker IPs / 104.243.35.0/24 seen in the related CVE-2026-12569 exploitation (7 IPs community-corroborated by TL_OSINT_Scan, ReliaQuest sightings). CVE-2026-126325 has no confirmed exploitation, so this is precursor coverage for the same deserialization RCE attack surface.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003
- **Data sources:** web:access_combined (Apache/Tomcat access log), web:ms:iis:auto (IIS W3C log), W3CIISLog (Sentinel), CommonSecurityLog (WAF/proxy)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```CVE-2026-126325 / CVE-2026-12569 precursor: Windchill web-shell and exploit-request hunting in web logs```
index=web (sourcetype=access_combined OR sourcetype="ms:iis:auto" OR sourcetype=iis) earliest=-24h
| eval uri=lower(coalesce(uri_path, cs_uri_stem, uri)), meth=upper(coalesce(http_method, cs_method, method)), client=coalesce(src, c_ip, clientip, src_ip)
| eval hex_jsp_post=if(meth="POST" AND match(uri,"^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$"),1,0)
| eval xreq_header=if(match(_raw,"(?i)x-windchill-req"),1,0)
| eval known_ioc_ip=if((cidrmatch("104.243.35.0/24",client) OR in(client,"5.180.41.35","216.152.148.54","216.152.151.204","104.243.35.63","104.243.35.131","172.111.38.31","74.50.76.146","104.194.9.14","209.222.98.44","185.227.83.236","78.128.113.10","38.60.157.212")) AND match(uri,"^/windchill/"),1,0)
| where hex_jsp_post=1 OR xreq_header=1 OR known_ioc_ip=1
| eval reason=mvappend(if(hex_jsp_post=1,"POST to hex-named JSP under /Windchill/login/",null()), if(xreq_header=1,"X-windchill-req header",null()), if(known_ioc_ip=1,"known CVE-2026-12569 attacker IP",null()))
| stats count min(_time) as first_seen max(_time) as last_seen values(reason) as reason values(uri) as uris values(status) as http_status by client host
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// CVE-2026-126325 / CVE-2026-12569 precursor: hex-named Windchill JSP web shell POSTs, X-windchill-req header, known attacker IPs
let KnownIPs = dynamic(["5.180.41.35", "216.152.148.54", "216.152.151.204", "104.243.35.63", "104.243.35.131", "172.111.38.31", "74.50.76.146", "104.194.9.14", "209.222.98.44", "185.227.83.236", "78.128.113.10", "38.60.157.212"]);
let IisHits = W3CIISLog
    | where TimeGenerated > ago(24h)
    | where (csMethod =~ "POST" and csUriStem matches regex @"(?i)^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$")
        or (csUriStem startswith "/Windchill" and (cIP in (KnownIPs) or ipv4_is_in_range(cIP, "104.243.35.0/24")))
    | project TimeGenerated, SourceIp = cIP, Host = Computer, Method = csMethod, Url = csUriStem, Status = tostring(scStatus), Evidence = "hex-named JSP POST or known attacker IP";
let WafHits = CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where AdditionalExtensions has "X-windchill-req" or Message has "X-windchill-req" or RequestURL matches regex @"(?i)/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp$"
    | project TimeGenerated, SourceIp = SourceIP, Host = Computer, Method = RequestMethod, Url = RequestURL, Status = tostring(EventOutcome), Evidence = "X-windchill-req header or hex JSP URL (WAF/proxy)";
union IisHits, WafHits
| order by TimeGenerated desc
```

### Sigma

```yaml
title: PTC Windchill Hex-Named JSP Web Shell POST or Known Campaign IP
id: 7c1e4b2a-3d58-4f1a-9b6e-2a8d51c0e101
status: experimental
description: Detects POST requests to hex-named JSP files (6 or 16 hex characters) under /Windchill/login/ and requests from IP infrastructure tied to the related CVE-2026-12569 Windchill exploitation campaign. Precursor hunting content for CVE-2026-126325 (Windchill/FlexPLM deserialization RCE).
references:
  - https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability
  - https://www.cve.org/CVERecord?id=CVE-2026-126325
  - https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html
  - https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html
author: Threadlinqs Team
date: 2026-11-14
tags:
  - cve.2026.126325
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_shell:
    cs-method: 'POST'
    c-uri|re: '(?i)^/windchill/login/([0-9a-f]{6}|[0-9a-f]{16})\.jsp(\?.*)?$'
  selection_ip:
    c-ip|cidr:
      - '5.180.41.35/32'
      - '216.152.148.54/32'
      - '216.152.151.204/32'
      - '104.243.35.63/32'
      - '104.243.35.131/32'
      - '172.111.38.31/32'
      - '74.50.76.146/32'
      - '104.194.9.14/32'
      - '209.222.98.44/32'
      - '185.227.83.236/32'
      - '78.128.113.10/32'
      - '38.60.157.212/32'
      - '104.243.35.0/24'
    c-uri|startswith: '/Windchill'
  condition: selection_shell or selection_ip
falsepositives:
  - Legitimate Windchill customisations that use short hex-named JSP files under /Windchill/login/ (unlikely, verify against change records)
  - Authorised vulnerability scanners or red-team activity from listed network ranges
level: high

```

**Known false positives:**

- Vulnerability scanners or penetration tests against Windchill that request /Windchill/login/ paths
- Legitimate short hex-named JSP files shipped by a Windchill customisation

**Tuning notes:** Ensure the web access log is indexed in index=web and that uri_path/cs_uri_stem, method and client IP fields are extracted; adjust index/sourcetype to your environment. Log the X-windchill-req header (custom log format or WAF) for header coverage. Exclude approved scanner IPs. Refresh the known-IP list from the PTC advisory and TL_OSINT_Scan.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PTC Windchill Java Server Spawning Shell or Interpreter (Exploitation) (locked: unlock with TL Creds)
- Windchill Engineering Data Staging via Archive Tools (locked: unlock with TL Creds)
- Windchill Server Bulk Egress to Public Destinations (locked: unlock with TL Creds)
- PTC Windchill Hex-Named JSP Web Shell File Creation (locked: unlock with TL Creds)
- Windchill Java Process Running File System Enumeration (locked: unlock with TL Creds)
- Windchill Campaign Attacker Infrastructure Network Contact (locked: unlock with TL Creds)
- Windchill File System Enumeration Artifact [indicator] (locked: unlock with TL Creds)
- Windchill Web Shell HTTP Command-and-Control Burst (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `5.180.41[.]35`
- File hash: `55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c`
- IP address: `216.152.148[.]54`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution](https://thehackernews.com/2026/11/ptc-patches-critical-windchill-and.html)
- [PTC Windchill and FlexPLM RCE Vulnerability - PTC Advisory](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)
- [CVE-2026-126325 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-126325)
- [CISA Adds Exploited PTC Windchill RCE Flaw (related CVE-2026-12569)](https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html)
- [Cl0p Affiliates Target Internet-Exposed Windchill (related CVE-2026-12569)](https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6073