Threat video1:00
CVE-2026-126325 PTC Windchill RCE: Detection & IOCs
Crafted requests run code on PTC Windchill and FlexPLM via deserialization. 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-126325 PTC Windchill RCE: Detection & IOCs →
Chapters
- 0:00The hookPTC patched a critical flaw: 9.2.
- 0:04The storyA sibling flaw was exploited.
- 0:11Attack pathSuspected affiliates chained a disclosure.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise15 indicators to hunt: 12 IPs, 1 IP range and 1 SHA-256 hash, and more.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to impact.
- 0:42Remediation5 steps now: Apply the PTC patch to all self-hosted Windchill and FlexPLM.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00PTC patched a critical flaw: 9.2.
0:05A sibling flaw was exploited.
0:07This one: no exploitation reported.
0:11Suspected affiliates chained a disclosure.
0:14Then a flaw gave remote code execution.
0:16Web shells were dropped. Data was staged.
0:19Extortion emails were reported.
0:24No threat actor is attributed. Confidence: low.
0:2915 indicators to hunt: 12 IPs, 1 IP range and 1 SHA-256 hash, and more.
0:388 ATT&CK techniques, from resource development to impact.
0:435 steps now: Apply the PTC patch to all self-hosted Windchill and FlexPLM.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.