Vulnerability Intelligence Report
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
CVE-2026-12569
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CISA KEV
SSVC: Active Exploitation
Automatable
Deserialization
CVSS Base Score
9.3
CRITICAL
EPSS Probability:2.26%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| No affected products specified. | ||
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
2.263%
GitHub Advisory
Vulnerability Class
Deserialization
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | PTC Inc. · Vendor · USA |
| Reserved | 2026-06-18T00:02:58 |
| Published | 2026-06-18T00:11:35 |
| Last Updated | 2026-08-01T03:55:29 |
Community Chatter & Buzz