# PTC vulnerabilities & exploitation **CISA KEV** > As of 2026-10-12, Threadlinqs tracks 5 PTC CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 9 tracked threat campaigns and 12 named threat actors. **Data as of:** 2026-10-12 ## Exploitation timeline Threadlinqs has recorded 5 PTC CVEs published between 2026-03-15 and 2026-08-15. The busiest month was 2026-08 (3 new CVEs). 1 of them (20%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked PTC CVEs. - [CVE-2026-12569](https://intel.threadlinqs.com/cve/CVE-2026-12569) — CRITICAL 9.8 · KEV · EPSS 1.1% · 2026-06-18 - [CVE-2026-4681](https://intel.threadlinqs.com/cve/CVE-2026-4681) — CRITICAL 9.3 · EPSS 0.8% · 2026-03-23 - [CVE-2026-77645](https://intel.threadlinqs.com/cve/CVE-2026-77645) — CRITICAL 9.2 · EPSS 0.5% · 2026-08-20 - [CVE-2026-77646](https://intel.threadlinqs.com/cve/CVE-2026-77646) — HIGH 7.7 · EPSS 0.3% · 2026-08-20 - [CVE-2026-77644](https://intel.threadlinqs.com/cve/CVE-2026-77644) — CRITICAL 9.3 · EPSS 0.3% · 2026-08-20 ## Products affected Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 3 distinct PTC products are affected. The most frequently affected: - FlexPLM — 4 CVEs - Windchill PDMLink — 4 CVEs - Windchill Risk and Reliability Enterprise Edition (Formerly Relex) — 1 CVE ## Threat activity 9 tracked threat campaigns reference PTC products or exploit PTC CVEs: - [GuidePoint GRIT Q3 2026 Ransomware Report: Record 2,760 Victims, New Top Group Edges Out Qilin, ShinyHunters Expands Extortion](https://intel.threadlinqs.com/threat/TL-2026-3183) — HIGH — 2026-10-10 - [Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569](https://intel.threadlinqs.com/threat/TL-2026-3135) — HIGH — 2026-10-09 - [2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)](https://intel.threadlinqs.com/threat/TL-2026-2125) — HIGH — 2026-08-23 - [CVE-2026-20230: Cisco Unified Communications Manager WebDialer SSRF Actively Exploited to Drop Tor-Routed JSP Webshells via Rogue Apache Axis Service, CISA Sets June 28 Deadline](https://intel.threadlinqs.com/threat/TL-2026-1236) — CRITICAL — 2026-07-11 - [CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies](https://intel.threadlinqs.com/threat/TL-2026-1134) — MEDIUM — 2026-07-06 - [CISA KEV: PTC Windchill RCE and Cisco Unified CM SSRF - Critical Remote Code Execution Vulnerabilities](https://intel.threadlinqs.com/threat/TL-2026-0971) — CRITICAL — 2026-06-28 - [CISA KEV: Cisco Unified Communications Manager SSRF to Webshell (CVE-2026-20230) Actively Exploited](https://intel.threadlinqs.com/threat/TL-2026-0960) — CRITICAL — 2026-06-27 - [CVE-2026-12569: PTC Windchill PDMLink / FlexPLM Unauthenticated Deserialization RCE (CISA KEV, JSP Web Shell Campaign)](https://intel.threadlinqs.com/threat/TL-2026-0954) — CRITICAL — 2026-06-26 - [CISA KEV Adds CVE-2026-12569 (PTC Windchill/FlexPLM Unauthenticated RCE via Deserialization) and CVE-2026-20230 (Cisco Unified CM WebDialer SSRF to Root)](https://intel.threadlinqs.com/threat/TL-2026-1244) — CRITICAL — 2026-06-25 ## Threat actors targeting PTC Named threat actors attributed to campaigns that involve PTC products or CVEs, with the number of linked campaigns: - [Clop](https://intel.threadlinqs.com/actor/Clop) — 3 campaigns - [Cl0p](https://intel.threadlinqs.com/actor/Cl0p) — 2 campaigns - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 2 campaigns - [Akira](https://intel.threadlinqs.com/actor/Akira) — 1 campaign - [Conti](https://intel.threadlinqs.com/actor/Conti) — 1 campaign - [DragonForce](https://intel.threadlinqs.com/actor/DragonForce) — 1 campaign - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 1 campaign - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 1 campaign - [Play - G1040](https://intel.threadlinqs.com/actor/Play%20-%20G1040) — 1 campaign - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 campaign - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 1 campaign - [Sinobi](https://intel.threadlinqs.com/actor/Sinobi) — 1 campaign ## How to prioritise PTC patching This order follows the data Threadlinqs holds for PTC, not a generic severity checklist: - 1 of 5 PTC CVEs (20%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-12569](https://intel.threadlinqs.com/cve/CVE-2026-12569). - Outside KEV, the highest EPSS scores are [CVE-2026-4681](https://intel.threadlinqs.com/cve/CVE-2026-4681) (0.8%), [CVE-2026-77645](https://intel.threadlinqs.com/cve/CVE-2026-77645) (0.5%), [CVE-2026-77646](https://intel.threadlinqs.com/cve/CVE-2026-77646) (0.3%). - 4 CVEs score Critical and 1 High on CVSS v3 (maximum 9.8, average 9.1); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/ptc All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp