Exploitation timeline
Threadlinqs has recorded 5 PTC CVEs published between and . The busiest month was 2026-08 (3 new CVEs). 1 of them (20%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked PTC CVEs.
- CVE-2026-12569critical 9.8KEVEPSS 1.1%
- CVE-2026-4681critical 9.3EPSS 0.8%
- CVE-2026-77645critical 9.2EPSS 0.5%
- CVE-2026-77646high 7.7EPSS 0.3%
- CVE-2026-77644critical 9.3EPSS 0.3%
Products affected
Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 3 distinct PTC products are affected. The most frequently affected:
- FlexPLM 4 CVEs
- Windchill PDMLink 4 CVEs
- Windchill Risk and Reliability Enterprise Edition (Formerly Relex) 1 CVE
Threat activity
9 tracked threat campaigns reference PTC products or exploit PTC CVEs:
- GuidePoint GRIT Q3 2026 Ransomware Report: Record 2,760 Victims, New Top Group Edges Out Qilin, ShinyHunters Expands ExtortionHIGH
- Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569HIGH
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)HIGH
- CVE-2026-20230: Cisco Unified Communications Manager WebDialer SSRF Actively Exploited to Drop Tor-Routed JSP Webshells via Rogue Apache Axis Service, CISA Sets June 28 DeadlineCRITICAL
- CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB AgenciesMEDIUM
- CISA KEV: PTC Windchill RCE and Cisco Unified CM SSRF - Critical Remote Code Execution VulnerabilitiesCRITICAL
- CISA KEV: Cisco Unified Communications Manager SSRF to Webshell (CVE-2026-20230) Actively ExploitedCRITICAL
- CVE-2026-12569: PTC Windchill PDMLink / FlexPLM Unauthenticated Deserialization RCE (CISA KEV, JSP Web Shell Campaign)CRITICAL
- CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM Unauthenticated RCE via Deserialization) and CVE-2026-20230 (Cisco Unified CM WebDialer SSRF to Root)CRITICAL
Threat actors targeting PTC
Named threat actors attributed to campaigns that involve PTC products or CVEs, with the number of linked campaigns:
How to prioritise PTC patching
This order follows the data Threadlinqs holds for PTC, not a generic severity checklist:
- 1 of 5 PTC CVEs (20%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2026-12569.
- Outside KEV, the highest EPSS scores are CVE-2026-4681 (0.8%), CVE-2026-77645 (0.5%), CVE-2026-77646 (0.3%).
- 4 CVEs score Critical and 1 High on CVSS v3 (maximum 9.8, average 9.1); sequence these after KEV and high-EPSS items.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily.