CVE-2026-12569KEV · OVERDUECWE-20CWE-502insecure-deserialization

PTC Windchill and FlexPLM Improper Input Validation Vulnerability

Critical · published June 18, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.8th percentile for exploit probability.

118
days past CISA
deadline
CVSS v3.1
9.8
EPSS
46%
Percentile
98.8
In the wild
Confirmed
What it is

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions

* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.46049 · 98.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-06-18T05:18Z
KEV added
2026-06-25 · due 2026-06-28
Affected products (19)
ProductVersionsFixed in
ptc/flexplm≤ 11.0m030—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/flexplmall versions—
ptc/windchill_pdmlink< 11.0m03011.0m030
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
ptc/windchill_pdmlinkall versions—
References (2)
https://www.ptc.com/en/support/article/CS473270 · 0b655efc-079c-4cb9-9e8d-164871239f4ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 28
    kev
  • 18 JUN 00:11Z
    Remote Code Execution (RCE) vulnerability in Windchill PDMlink
    cvelistv5