Vulnerability Intelligence Report
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
CVE-2026-12569
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CISA KEV
SSVC: Active Exploitation
Automatable
Deserialization
CVSS Base Score
9.3
CRITICAL
EPSS Probability:2.26%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PTC | Windchill PDMLink | 0 <= 11.0 M030 (affected), 11.1 M020 (affected), 11.2.1.0 (affected), 12.0.2.0 (affected), 12.1.2.0 (affected), 13.0.2.0 (affected), 13.1.0.0 (affected), 13.1.1.0 (affected), 13.1.2.0 (affected), 13.1.3.0 (affected) |
| PTC | FlexPLM | 0 <= 11.0 M030 (affected), 11.1 M020 (affected), 11.2.1.0 (affected), 12.0.0.0 (affected), 12.0.2.0 (affected), 12.1.2.0 (affected), 12.1.3.0 (affected), 13.0.2.0 (affected), 13.0.3.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
2.263%
GitHub Advisory
Vulnerability Class
Deserialization
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | PTC Inc. · Vendor · USA |
| Reserved | 2026-06-18T00:02:58 |
| Published | 2026-06-18T00:11:35 |
| Last Updated | 2026-08-01T03:55:29 |
Community Chatter & Buzz